Network Protocol Reverse Engineering GNFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is modeling a protocol that uses a challenge-response authentication. The client sends a 'CHALLENGE' message, the server responds with a 'CHALLENGE_RESPONSE' that includes a nonce, and the client must then send an 'AUTH' message with a hash of the nonce. If the client sends an 'AUTH' message without receiving a 'CHALLENGE_RESPONSE', what does this indicate?

   • AThe server is not responding, so the client is retransmitting the 'AUTH' message.
   • BThe protocol allows the client to send 'AUTH' at any time, and this is normal behavior.
   • CThe client is using a cached nonce from a previous session, which is a valid optimization.
   • DThe client is violating the protocol state machine, which may indicate malicious activity or a bug.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is tasked with reverse engineering an unknown protocol captured in a pcap. The traffic is between two internal hosts on a non-standard port. The analyst notices that the first packet of each session contains a 4-byte value that increments by one for each new session. What is the most likely purpose of this field?

   • AA checksum or integrity check
   • BA random nonce for encryption
   • CA fixed protocol version number
   • DA session identifier or sequence number
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which field in an IPv4 header is used to prevent packets from looping indefinitely?

   • AProtocol
   • BSource address
   • CTime to Live (TTL)
   • DHeader checksum
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is reverse engineering an unknown protocol used by malware. The analyst has captured a large number of sessions and notices that the first packet of each session contains a 4-byte value that is always a multiple of 4. The analyst also notices that the value increases with each session. What is the most likely purpose of this field?

   • AA random nonce that happens to be a multiple of 4
   • BA sequence number that increments by a fixed amount, possibly indicating a message counter
   • CA timestamp that is a multiple of 4
   • DA checksum that is always a multiple of 4
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an incident response, an analyst captures traffic from a host that communicates with a command-and-control server. The payloads appear to be base64-encoded. After decoding, the analyst sees a string that looks like 'H4sIAAAAAAAAA...'. What is the most likely next step to decode the full payload?

   • AUse a TLS decryption tool because the payload is likely encrypted.
   • BTreat the string as a hexadecimal-encoded payload and convert it to ASCII.
   • CDecode the string again using base64, as double encoding is common in malware.
   • DDecompress the base64-decoded data using gzip or zlib, as the 'H4sI' header indicates a gzip-compressed stream.
   Reveal Solution Discussion Select an answer first