Network Protocol Reverse Engineering GNFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic analyst is reconstructing a file transfer from a pcap. The TCP stream shows packets arriving out of order and with retransmissions. The analyst uses Wireshark's 'Follow TCP Stream' feature. What is the primary reason this feature is effective for this task?

   • AIt decrypts any TLS-encrypted traffic in the stream
   • BIt filters out all other traffic and shows only the file transfer packets
   • CIt decodes the application-layer protocol and extracts the file automatically
   • DIt reassembles the TCP segments in sequence order, handling retransmissions and out-of-order packets
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   An analyst is dissecting a packet from a custom protocol. The first 2 bytes are 0x1234, the next 2 bytes are 0x0005, and the remaining bytes are the payload. The analyst knows that the first field is a magic number and the second field is a length field. If the length field is in network byte order (big-endian), what is the length of the payload?

   • A5 bytes
   • BThe length cannot be determined without knowing the payload content.
   • C1280 bytes
   • D20 bytes
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is reviewing traffic from a network that uses a proprietary protocol on TCP port 5000. The analyst sees a session on port 5000 that uses a standard HTTP GET request. The analyst also sees another session on port 5000 that uses a custom binary protocol with a magic number. What should the analyst conclude?

   • AThe network has a mix of traffic on port 5000, including both HTTP and the proprietary protocol, which may indicate a policy violation
   • BThe proprietary protocol is actually HTTP with a custom header
   • CThe proprietary protocol has been updated to use HTTP
   • DThe HTTP traffic is a false positive and can be ignored
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing traffic from a network that is known to use a proprietary protocol on TCP port 5000. The analyst sees a session on port 5000 that uses a standard HTTP GET request. What should the analyst conclude?

   • AThe proprietary protocol has been updated to use HTTP
   • BThe traffic is a false positive and can be ignored
   • CThe traffic is likely HTTP, not the proprietary protocol, and may indicate a policy violation or misconfiguration
   • DThe traffic is definitely the proprietary protocol because it is on the expected port
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is monitoring a network that uses a custom protocol over TCP. The protocol normally sends a 'REQUEST' message and waits for a 'RESPONSE' message. The analyst observes a session where the client sends a 'REQUEST', the server sends a 'RESPONSE', and then the client sends another 'REQUEST' without waiting for a response to the first. Which of the following is the most likely explanation?

   • AThe server is not responding, so the client is retransmitting the request.
   • BThe traffic is actually two separate sessions that are being interleaved.
   • CThe protocol is broken, and the client is not following the specification.
   • DThe client is pipelining requests, which is a deviation from the expected request-response pattern but may be a valid optimization.
   Reveal Solution Discussion Select an answer first