A forensic analyst is examining a PCAP and sees traffic that appears to be encrypted. The analyst wants to determine if the traffic is using TLS or IPsec. Which observation would best differentiate between the two?

TLS is always on port 22, while IPsec is always on port 443.

TLS uses AH headers, while IPsec uses a ClientHello message.

TLS typically uses TCP port 443, while IPsec uses UDP port 500 for IKE.

TLS uses ESP headers, while IPsec uses a handshake with certificates.

A network analyst is investigating a PCAP and sees traffic on UDP port 500 and UDP port 4500. The analyst suspects IPsec is being used. What additional evidence would confirm that IPsec is protecting the traffic?

The presence of SSH banners on port 4500.

The presence of IKE SA_INIT packets followed by ESP packets on port 4500.

The presence of TLS ClientHello messages on port 500.

The presence of HTTP requests on port 4500.

A forensic analyst is examining a PCAP and finds that a client and server are using a protocol that uses a 2048-bit key for key exchange and a 128-bit key for data encryption. The analyst needs to identify the algorithms. Which combination is most likely?

RSA-2048 for key exchange and AES-128 for data encryption

SHA-2048 for key exchange and Base64-128 for data encryption

AES-2048 for key exchange and RSA-128 for data encryption

Blowfish-2048 for key exchange and 3DES-128 for data encryption

In a network capture, an analyst sees that a client and server are using a protocol that exchanges a public key and then uses a shared session key for bulk data encryption. This scenario best illustrates which combination of cryptographic concepts?

Symmetric encryption for both key exchange and data transfer

Hashing for key exchange and symmetric encryption for data transfer

Asymmetric encryption for key exchange and symmetric encryption for data transfer

Symmetric encryption for key exchange and asymmetric encryption for data transfer

A forensic analyst is examining a PCAP and finds a string that appears to be encoded. The analyst suspects it may be Base64, hex, or URL encoded. Which of the following observations would help determine the encoding scheme? (Select all that apply.)

The string is reversible without a key.

The string contains only characters 0-9 and A-F.

The string contains percent signs followed by two hex digits.

The string contains only characters A-Z, a-z, 0-9, '+', '/', and '='.

The string contains a mix of uppercase and lowercase letters.

GIAC Network Forensic Analyst

Domain 4Objective 1

Encryption and Encoding GNFA Practice Questions (Page 1)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 1–5

1application · medium
A forensic analyst is examining a PCAP and sees traffic that appears to be encrypted. The analyst wants to determine if the traffic is using TLS or IPsec. Which observation would best differentiate between the two?
Select an answer first
2expert · medium
A network analyst is investigating a PCAP and sees traffic on UDP port 500 and UDP port 4500. The analyst suspects IPsec is being used. What additional evidence would confirm that IPsec is protecting the traffic?
Select an answer first
3expert · hard
A forensic analyst is examining a PCAP and finds that a client and server are using a protocol that uses a 2048-bit key for key exchange and a 128-bit key for data encryption. The analyst needs to identify the algorithms. Which combination is most likely?
Select an answer first
4foundation · easy
In a network capture, an analyst sees that a client and server are using a protocol that exchanges a public key and then uses a shared session key for bulk data encryption. This scenario best illustrates which combination of cryptographic concepts?
Select an answer first
5expert · hard · select all that apply
A forensic analyst is examining a PCAP and finds a string that appears to be encoded. The analyst suspects it may be Base64, hex, or URL encoded. Which of the following observations would help determine the encoding scheme? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.