Which of the following is a characteristic of TFTP (Trivial File Transfer Protocol)?

It provides authentication and directory listing.

It is a simple protocol that uses UDP and is often used for network booting.

It supports secure encrypted transfers.

It uses TCP for reliable file transfer.

A forensic analyst is reviewing a packet capture from a server that experienced a denial-of-service attack. The capture shows a large number of TCP SYN packets sent to the server's port 80, but no corresponding SYN-ACK replies from the server. The server's TCP stack is configured with a SYN backlog limit. What is the most likely effect of this attack?

The server is using SYN cookies, so it is not affected by the SYN flood and continues to serve legitimate clients.

The server's SYN backlog queue is filled, causing it to drop new connection requests, leading to a denial of service for legitimate clients.

The attack is using UDP packets, not TCP, so the server's TCP stack is not affected.

The server is responding with SYN-ACK packets, but they are being dropped by the network due to ICMP rate limiting.

GIAC Network Forensic Analyst

Domain 1Objective 1

Common Network Protocols GNFA Practice Questions (Page 7)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 56 practice questions to prepare you well beyond it. (estimate)

56questions here

12free pages

13concepts

Questions 31–35

31foundation · easy
Which of the following protocols operates at the application layer of the TCP/IP model?
Select an answer first
32foundation · easy
Which of the following is a characteristic of TFTP (Trivial File Transfer Protocol)?
Select an answer first
33expert · hard
A forensic analyst is reviewing a packet capture from a server that experienced a denial-of-service attack. The capture shows a large number of TCP SYN packets sent to the server's port 80, but no corresponding SYN-ACK replies from the server. The server's TCP stack is configured with a SYN backlog limit. What is the most likely effect of this attack?
Select an answer first
34foundation · easy
In the HTTP request-response model, which HTTP method is typically used to retrieve data from a specified resource?
Select an answer first
35application · easy
A network administrator is planning a new subnet for 50 hosts. The network uses IPv4. Which subnet mask should be used to provide enough addresses while minimizing waste?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Common Network Protocols GNFA Practice Questions (Page 7)

Questions 31–35

Which of the following protocols operates at the application layer of the TCP/IP model?

Which of the following is a characteristic of TFTP (Trivial File Transfer Protocol)?

In the HTTP request-response model, which HTTP method is typically used to retrieve data from a specified resource?

A network administrator is planning a new subnet for 50 hosts. The network uses IPv4. Which subnet mask should be used to provide enough addresses while minimizing waste?

Keep studying — Network Fundamentals and Architecture