Encryption and Encoding GNFA Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security analyst is reviewing a network capture and finds a string that appears to be `SGVsbG8gV29ybGQ=`. The analyst suspects it is encoded. What is the correct interpretation?

   • AIt is encrypted with AES and requires a key.
   • BIt is URL-encoded and decodes to a path.
   • CIt is hex-encoded and decodes to a binary blob.
   • DIt is Base64-encoded and decodes to 'Hello World'.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer is selecting a protocol for a remote administration tool that must provide confidentiality, integrity, and authentication. The tool will be used over the internet. Which protocol is the best choice?

   • ATelnet with a username and password.
   • BFTP with SSL/TLS (FTPS) using anonymous access.
   • CHTTP with Basic authentication.
   • DSSH with public-key authentication.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a forensic investigation, you extract a suspicious string from a PCAP file: `aHR0cDovL2V2aWwudGVzdC9wYXlsb2Fk`. The string appears to be a URL that was obfuscated before being sent over HTTP. Which action correctly identifies the nature of this string and the appropriate next step?

   • AIt is hex-encoded data; convert each pair of hex digits to ASCII to reveal the URL.
   • BIt is Base64-encoded data; decode it to reveal the plaintext URL and then investigate the destination.
   • CIt is URL-encoded data; replace percent-encoded sequences to reveal the original URL.
   • DIt is AES-encrypted data; you need the encryption key to recover the URL.
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A network analyst is investigating a PCAP and sees traffic on TCP port 22. The analyst wants to determine if the traffic is encrypted and if so, what protocol is being used. What is the most reliable indicator?

   • AThe presence of encrypted payloads that do not match any known plaintext.
   • BThe presence of TLS ClientHello messages.
   • CThe absence of any plaintext HTTP requests on the same port.
   • DThe presence of an SSH version string like 'SSH-2.0-OpenSSH_8.9' in the first packet.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A forensic analyst needs to decode a Base64 string found in a network capture. Which command-line tool is specifically designed for this task?

   • Atcpdump
   • Bbase64
   • Copenssl
   • Dwireshark
   Reveal Solution Discussion Select an answer first