During an investigation, an analyst extracts a suspicious string from a DNS query: 'dGVzdGluZ3NlY3JldA=='. The analyst suspects it is a covert data exfiltration channel. What is the most appropriate first step to interpret this string?

Convert it from hexadecimal to ASCII.

Decode it as Base64 to reveal the plaintext.

Run it through a hash function to identify the algorithm.

Decrypt it with AES using a key derived from the domain name.

A forensic analyst is analyzing a PCAP and finds that a client is using a weak encryption algorithm to communicate with a server. The analyst suspects that the traffic can be decrypted offline. Which approach is most appropriate to recover the plaintext?

Use a dictionary attack against the captured key exchange to recover the pre-shared key.

Replay the captured packets to the server to observe the response.

Use the server's private key from the PCAP to decrypt the traffic.

Decode the Base64-encoded payload to reveal the plaintext.

A forensic analyst has captured traffic that uses a legacy encryption algorithm with a 56-bit key. The analyst has limited time and computational resources. Which approach is most practical to recover the plaintext?

Use a brute-force attack with a GPU cluster to try all possible keys.

Request the private key from the server administrator.

Use a known-plaintext attack to derive the key from a single pair.

Decode the Base64-encoded payload to reveal the plaintext.

A network analyst is investigating a PCAP that contains both TLS and SSH traffic. The analyst needs to determine which sessions are encrypted and which are not. Which approach is most reliable?

Identify the protocol by analyzing the handshake messages and banners.

Use the IP addresses to determine the encryption protocol.

Assume all traffic on port 443 is TLS and all traffic on port 22 is SSH.

Check for the presence of HTTP GET requests in the payload.

A network administrator is designing a secure file transfer system. The requirement is to ensure that the file is not modified in transit and that the sender is authenticated. Which mechanism should be used?

Use AES encryption with a shared key.

Use a hash function like SHA-256 only.

Use a digital signature with the sender's private key.

Use Base64 encoding to prevent modification.

GIAC Network Forensic Analyst

Domain 4Objective 1

Encryption and Encoding GNFA Practice Questions (Page 5)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 21–25

21application · easy
During an investigation, an analyst extracts a suspicious string from a DNS query: 'dGVzdGluZ3NlY3JldA=='. The analyst suspects it is a covert data exfiltration channel. What is the most appropriate first step to interpret this string?
Select an answer first
22application · medium
A forensic analyst is analyzing a PCAP and finds that a client is using a weak encryption algorithm to communicate with a server. The analyst suspects that the traffic can be decrypted offline. Which approach is most appropriate to recover the plaintext?
Select an answer first
23expert · hard
A forensic analyst has captured traffic that uses a legacy encryption algorithm with a 56-bit key. The analyst has limited time and computational resources. Which approach is most practical to recover the plaintext?
Select an answer first
24expert · hard
A network analyst is investigating a PCAP that contains both TLS and SSH traffic. The analyst needs to determine which sessions are encrypted and which are not. Which approach is most reliable?
Select an answer first
25application · medium
A network administrator is designing a secure file transfer system. The requirement is to ensure that the file is not modified in transit and that the sender is authenticated. Which mechanism should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.