An analyst is troubleshooting IPv6 connectivity between two hosts on the same link. Host A can ping Host B's link-local address, but cannot ping Host B's global unicast address. The analyst captures traffic and sees Host A sending Neighbor Solicitations for the global address, but receiving no Neighbor Advertisements. Which configuration issue is most likely the cause?

Host A's firewall is blocking ICMPv6 Neighbor Advertisements for the global address but allowing them for the link-local address.

The router is not advertising the prefix, so Host B cannot form a global address, but the link-local address works.

Host B has not been configured with the global unicast address, or the address is not assigned to its interface.

Host A's global address is on a different subnet than Host B's global address, so the NS is sent to the wrong solicited-node multicast group.

Which of the following is a characteristic of UDP compared to TCP?

UDP is connectionless and does not guarantee delivery.

UDP provides reliable, ordered delivery of data.

UDP uses a three-way handshake to establish connections.

UDP includes flow control and congestion avoidance mechanisms.

In an Ethernet frame, what is the primary purpose of the destination MAC address field?

To specify the source device that sent the frame

To identify the network layer protocol carried in the payload

To identify the intended receiving device on the local network

To provide error detection for the frame contents

An analyst is reviewing a packet capture from a compromised workstation. The capture shows a DNS query for 'update.contoso.com' followed by a response containing an A record with IP 203.0.113.50. The workstation then establishes a TCP connection to 203.0.113.50 on port 443. Which protocol-layer sequence is correctly represented in this capture?

Data-link layer DNS (ARP/53) resolves the name, then the application layer HTTPS (TCP/443) carries the session.

Transport layer DNS (TCP/53) resolves the name, then the session layer TLS (TCP/443) carries the traffic.

Network layer DNS (ICMP/53) resolves the name, then the transport layer HTTPS (UDP/443) carries the session.

Application layer DNS (UDP/53) resolves the name, then the application layer HTTPS (TCP/443) carries the session.

A network administrator needs to transfer a large configuration file to a network device. The device supports both FTP and TFTP. The administrator is concerned about security because the file contains sensitive credentials. Which protocol should the administrator use, and what additional measure should be taken?

Use FTP without encryption because it is the standard protocol for transferring configuration files.

Use TFTP because it is simpler and faster, and the file will be transferred over a trusted internal network.

Use FTP with TLS (FTPS) to encrypt the transfer, ensuring the credentials are protected during transmission.

Use TFTP with a VPN to encrypt the transfer, but the VPN adds overhead and complexity.

GIAC Network Forensic Analyst

Domain 1Objective 1

Common Network Protocols GNFA Practice Questions (Page 5)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

13concepts

Questions 21–25

21expert · hard
An analyst is troubleshooting IPv6 connectivity between two hosts on the same link. Host A can ping Host B's link-local address, but cannot ping Host B's global unicast address. The analyst captures traffic and sees Host A sending Neighbor Solicitations for the global address, but receiving no Neighbor Advertisements. Which configuration issue is most likely the cause?
Select an answer first
22foundation · easy
Which of the following is a characteristic of UDP compared to TCP?
Select an answer first
23foundation · easy
In an Ethernet frame, what is the primary purpose of the destination MAC address field?
Select an answer first
24application · medium
An analyst is reviewing a packet capture from a compromised workstation. The capture shows a DNS query for 'update.contoso.com' followed by a response containing an A record with IP 203.0.113.50. The workstation then establishes a TCP connection to 203.0.113.50 on port 443. Which protocol-layer sequence is correctly represented in this capture?
Select an answer first
25expert · hard
A network administrator needs to transfer a large configuration file to a network device. The device supports both FTP and TFTP. The administrator is concerned about security because the file contains sensitive credentials. Which protocol should the administrator use, and what additional measure should be taken?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Common Network Protocols GNFA Practice Questions (Page 5)

Questions 21–25

Which of the following is a characteristic of UDP compared to TCP?

In an Ethernet frame, what is the primary purpose of the destination MAC address field?

Keep studying — Network Fundamentals and Architecture