An analyst is examining a PCAP and finds a file that was transferred via HTTP. The file appears to be encrypted, but the analyst notices that the first 16 bytes of the file are identical to the first 16 bytes of another file captured earlier. What does this observation suggest?

The files are compressed with the same compression algorithm, resulting in identical headers.

The files are simply encoded with Base64, which produces identical prefixes for identical plaintext.

The files are encrypted with the same key and IV, likely using a weak mode like ECB or a reused nonce.

The files are using a stream cipher with a reused keystream.

A forensic analyst is investigating a network capture and finds a suspicious string in a DNS query: 'c2VjcmV0ZGF0YQ==.malware.example.com'. The analyst wants to extract the hidden data. What is the most appropriate tool or technique?

Use a Base64 decoder on the subdomain label.

Use a hash cracker to reverse the string.

Use a hex decoder on the entire domain name.

Use a TLS decryption tool to decrypt the DNS traffic.

An analyst is reviewing a PCAP and finds a string that looks like 'SGVsbG8gV29ybGQ='. The analyst wants to determine if this is encrypted or encoded. What is the most definitive way to make this determination?

Run it through a hash function and compare with known hashes.

Decode it as Base64 and see if the result is readable text.

Check the length of the string; if it is a multiple of 16, it is encrypted.

Look for the presence of '=' padding; if present, it is encrypted.

A forensic analyst is examining a network capture and finds a suspicious string in an HTTP request: '%48%65%6c%6c%6f'. The analyst wants to determine if this is an encoded payload or part of an attack. What tool or technique would be most appropriate to interpret this string?

Use an AES decryption tool with a known key.

Use a URL decoder to convert percent-encoded characters to ASCII.

Use a Base64 decoder to convert the string to plaintext.

Use a hex editor to interpret the string as raw hexadecimal bytes.

A network analyst observes a string in an HTTP request that appears as '%48%65%6C%6C%6F'. What is the most accurate classification of this transformation?

Encryption, because it hides the original text from casual observation

Hashing, because it produces a fixed-length output

Encoding, because it is a reversible representation that does not require a secret key

Compression, because it reduces the size of the data

GIAC Network Forensic Analyst

Domain 4Objective 1

Encryption and Encoding GNFA Practice Questions (Page 7)

Part of the Advanced Analysis Techniques domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 31–35

31application · medium
An analyst is examining a PCAP and finds a file that was transferred via HTTP. The file appears to be encrypted, but the analyst notices that the first 16 bytes of the file are identical to the first 16 bytes of another file captured earlier. What does this observation suggest?
Select an answer first
32application · easy
A forensic analyst is investigating a network capture and finds a suspicious string in a DNS query: 'c2VjcmV0ZGF0YQ==.malware.example.com'. The analyst wants to extract the hidden data. What is the most appropriate tool or technique?
Select an answer first
33application · easy
An analyst is reviewing a PCAP and finds a string that looks like 'SGVsbG8gV29ybGQ='. The analyst wants to determine if this is encrypted or encoded. What is the most definitive way to make this determination?
Select an answer first
34application · easy
A forensic analyst is examining a network capture and finds a suspicious string in an HTTP request: '%48%65%6c%6c%6f'. The analyst wants to determine if this is an encoded payload or part of an attack. What tool or technique would be most appropriate to interpret this string?
Select an answer first
35foundation · easy
A network analyst observes a string in an HTTP request that appears as '%48%65%6C%6C%6F'. What is the most accurate classification of this transformation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.