A network analyst is capturing traffic and notices that a client sends a DNS query and receives a response, but the subsequent HTTP request to the resolved IP address times out. Which protocol or service should the analyst examine to determine why the HTTP request failed?

TCP handshake between the client and the web server

ARP requests from the web server

UDP packets from the client to the web server

A network analyst observes that a host on VLAN 10 can ping a host on VLAN 20, but cannot establish a TCP connection to a service on that host. Both hosts are connected to the same Layer 3 switch. The analyst checks the switch's access control lists (ACLs) and finds no explicit deny statements. Which additional factor should the analyst investigate?

The Layer 3 switch may not be routing between VLANs.

The service may be bound only to a specific IP address or interface on the destination host.

The destination host's firewall may be blocking ICMP.

The source host's ARP cache may be stale.

A network administrator is tracing the path of a packet from a client at 192.168.1.10/24 to a server at 10.0.0.20/24. The client's default gateway is 192.168.1.1. Which sequence of actions occurs first?

The client checks its routing table and sends the packet to the default gateway.

The client sends an ARP request for the server's MAC address.

The client sends a DNS query for the server's hostname.

The client encapsulates the packet in a frame addressed to the server's MAC address.

A network analyst is investigating a slow web browsing experience. The capture shows many TCP retransmissions and duplicate ACKs for HTTP traffic. Which protocol behavior is most likely causing the issue?

TCP is performing congestion control and reducing the window size due to packet loss.

DNS is failing to resolve the domain, causing repeated queries.

UDP is being used for HTTP, causing unreliable delivery and retransmissions.

The switch is flooding all frames because the MAC address table is full.

GIAC Network Forensic Analyst

Domain 1Objective 2

Network Architecture GNFA Practice Questions (Page 5)

Part of the Network Fundamentals and Architecture domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 9–16 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

7concepts

Questions 21–25

21application · medium
A network analyst is capturing traffic and notices that a client sends a DNS query and receives a response, but the subsequent HTTP request to the resolved IP address times out. Which protocol or service should the analyst examine to determine why the HTTP request failed?
Select an answer first
22expert · medium
A network analyst observes that a host on VLAN 10 can ping a host on VLAN 20, but cannot establish a TCP connection to a service on that host. Both hosts are connected to the same Layer 3 switch. The analyst checks the switch's access control lists (ACLs) and finds no explicit deny statements. Which additional factor should the analyst investigate?
Select an answer first
23foundation · easy
Which CIDR notation represents a subnet mask of 255.255.255.0?
Select an answer first
24application · medium
A network administrator is tracing the path of a packet from a client at 192.168.1.10/24 to a server at 10.0.0.20/24. The client's default gateway is 192.168.1.1. Which sequence of actions occurs first?
Select an answer first
25application · medium
A network analyst is investigating a slow web browsing experience. The capture shows many TCP retransmissions and duplicate ACKs for HTTP traffic. Which protocol behavior is most likely causing the issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Architecture GNFA Practice Questions (Page 5)

Questions 21–25

A network analyst is capturing traffic and notices that a client sends a DNS query and receives a response, but the subsequent HTTP request to the resolved IP address times out. Which protocol or service should the analyst examine to determine why the HTTP request failed?

Which CIDR notation represents a subnet mask of 255.255.255.0?

A network administrator is tracing the path of a packet from a client at 192.168.1.10/24 to a server at 10.0.0.20/24. The client's default gateway is 192.168.1.1. Which sequence of actions occurs first?

A network analyst is investigating a slow web browsing experience. The capture shows many TCP retransmissions and duplicate ACKs for HTTP traffic. Which protocol behavior is most likely causing the issue?

Keep studying — Network Fundamentals and Architecture