An analyst suspects that a legacy protocol is using a weak encryption algorithm. Which characteristic would make an encryption algorithm particularly vulnerable to cryptanalysis?

Use of a public-key algorithm for key exchange

A large key space, such as 256-bit keys

A small key size, such as 40-bit keys

Use of a block cipher mode like AES-GCM

A network analyst captures traffic from a compromised host and notices that the host is communicating with an external server on TCP port 443. The analyst wants to determine whether the traffic is encrypted and, if so, which protocol is in use. Which approach is most appropriate?

Inspect the TLS ClientHello message to identify the cipher suites and SNI extension.

Assume the traffic is encrypted because port 443 is used, and skip further analysis.

Check for the presence of an SSH banner in the payload to confirm encryption.

Decrypt the traffic using the server's private key, which is available in the PCAP.

An analyst is investigating a PCAP that contains TLS traffic to a server. The analyst has access to the server's private key. Which tool or technique would allow the analyst to decrypt the TLS traffic?

Use a packet capture tool to replay the traffic to the server.

Use a hash cracker to recover the session key from the private key.

Use Wireshark with the private key configured in SSL/TLS preferences.

Use a Base64 decoder on the encrypted payloads.

A forensic analyst is examining a PCAP and finds that a client and server are using a protocol that encrypts each packet with a session key derived from a pre-shared key. The analyst needs to identify the encryption algorithm from the captured handshake. Which algorithm is most likely being used if the handshake shows a 256-bit key and the protocol is IPsec?

AES-256 in a mode like GCM or CBC

GIAC Network Forensic Analyst

Domain 4Objective 1

Encryption and Encoding GNFA Practice Questions (Page 6)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 26–30

26foundation · easy
An analyst suspects that a legacy protocol is using a weak encryption algorithm. Which characteristic would make an encryption algorithm particularly vulnerable to cryptanalysis?
Select an answer first
27application · medium
A network analyst captures traffic from a compromised host and notices that the host is communicating with an external server on TCP port 443. The analyst wants to determine whether the traffic is encrypted and, if so, which protocol is in use. Which approach is most appropriate?
Select an answer first
28foundation · easy
A forensic analyst is reviewing a PCAP and sees traffic on TCP port 443 with a TLS handshake. Which protocol is most likely being used?
Select an answer first
29expert · hard
An analyst is investigating a PCAP that contains TLS traffic to a server. The analyst has access to the server's private key. Which tool or technique would allow the analyst to decrypt the TLS traffic?
Select an answer first
30application · medium
A forensic analyst is examining a PCAP and finds that a client and server are using a protocol that encrypts each packet with a session key derived from a pre-shared key. The analyst needs to identify the encryption algorithm from the captured handshake. Which algorithm is most likely being used if the handshake shows a 256-bit key and the protocol is IPsec?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Encryption and Encoding GNFA Practice Questions (Page 6)

Questions 26–30

An analyst suspects that a legacy protocol is using a weak encryption algorithm. Which characteristic would make an encryption algorithm particularly vulnerable to cryptanalysis?

A network analyst captures traffic from a compromised host and notices that the host is communicating with an external server on TCP port 443. The analyst wants to determine whether the traffic is encrypted and, if so, which protocol is in use. Which approach is most appropriate?

A forensic analyst is reviewing a PCAP and sees traffic on TCP port 443 with a TLS handshake. Which protocol is most likely being used?

An analyst is investigating a PCAP that contains TLS traffic to a server. The analyst has access to the server's private key. Which tool or technique would allow the analyst to decrypt the TLS traffic?

Keep studying — Advanced Analysis Techniques