An analyst is examining traffic from a SCADA environment. The protocol uses a request-response pattern where the client sends a command and the server responds with an acknowledgment. The analyst notices that the server sometimes sends an unsolicited response without a preceding request. What should the analyst conclude?

This is normal behavior for a SCADA protocol

This is a protocol anomaly that may indicate a malfunction or malicious activity

The client must have sent a request that was not captured

The server is using a different protocol than expected

A malware analyst is reverse engineering a custom protocol from a pcap. The protocol uses TCP and each message starts with a 4-byte length field (little-endian) followed by the payload. The analyst notices that the length field sometimes indicates a value larger than the actual payload in the packet. What is the most likely reason for this discrepancy?

The length field indicates the total message length, which may span multiple TCP segments, so the payload in a single packet can be shorter.

The length field is encrypted, so its value is not meaningful until decrypted.

The length field is a checksum and is not related to the payload size.

The protocol is using UDP, and the length field includes the UDP header.

GIAC Network Forensic Analyst

Domain 2Objective 2

Network Protocol Reverse Engineering GNFA Practice Questions (Page 3)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 11–15

11foundation · easy
Which encoding scheme is commonly used to represent binary data in an ASCII string format, often seen in email attachments and HTTP payloads?
Select an answer first
12application · medium
An analyst is examining traffic from a SCADA environment. The protocol uses a request-response pattern where the client sends a command and the server responds with an acknowledgment. The analyst notices that the server sometimes sends an unsolicited response without a preceding request. What should the analyst conclude?
Select an answer first
13foundation · easy
In a TCP header, which field is used to indicate the starting byte number of the data segment being sent?
Select an answer first
14expert · hard
A malware analyst is reverse engineering a custom protocol from a pcap. The protocol uses TCP and each message starts with a 4-byte length field (little-endian) followed by the payload. The analyst notices that the length field sometimes indicates a value larger than the actual payload in the packet. What is the most likely reason for this discrepancy?
Select an answer first
15foundation · easy
An analyst sees a series of packets with a three-way handshake followed by encrypted application data on TCP port 443. Which protocol is most likely in use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Protocol Reverse Engineering GNFA Practice Questions (Page 3)

Questions 11–15

Which encoding scheme is commonly used to represent binary data in an ASCII string format, often seen in email attachments and HTTP payloads?

In a TCP header, which field is used to indicate the starting byte number of the data segment being sent?

An analyst sees a series of packets with a three-way handshake followed by encrypted application data on TCP port 443. Which protocol is most likely in use?

Keep studying — Network Traffic Analysis and Visualization