Network Protocol Reverse Engineering GNFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing a pcap from a compromised host. The traffic shows a TCP session on port 4444 with a steady, bidirectional flow of small packets every 2 seconds. The payloads begin with a 4-byte magic value '0xDEADBEEF' followed by a 2-byte length field and then data. The session persists for 3 hours and the remote IP is a known C2 infrastructure. Which combination of indicators most strongly suggests this is a custom C2 protocol rather than a standard service?

   • AThe TCP session is long-lived and uses a well-known port, indicating a standard protocol
   • BThe payloads are encrypted and the session uses TLS, so it must be a standard protocol
   • CThe session uses UDP instead of TCP, which is the only sign of a custom protocol
   • DThe use of a non-standard port, a consistent beacon interval, and a custom magic value in the payload
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the first step in reverse engineering an unknown protocol from a packet capture?

   • AModify the protocol implementation
   • BWrite a parser for the protocol
   • CIdentify the endpoints and group packets into sessions
   • DDecrypt all traffic
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During a packet capture review, an analyst observes traffic to TCP port 445 with SMB negotiation and session setup messages. Which protocol is most likely represented in this traffic?

   • AHTTP
   • BSMTP
   • CDNS
   • DSMB
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is monitoring a custom SCADA protocol that uses a strict request-response pattern. The protocol has a defined timeout of 5 seconds for responses. The analyst observes that the server sometimes sends a response after 10 seconds, and the client does not retransmit the request. What is the most likely explanation?

   • AThe server is experiencing delays that exceed the protocol timeout, which is a protocol anomaly
   • BThe client is not following the protocol because it should retransmit after the timeout
   • CThe protocol has been updated to allow longer response times
   • DThe network is slow, so the response is delayed but still valid
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is reassembling a file transfer over HTTP. The TCP stream contains multiple segments, and some segments are retransmitted. The analyst wants to extract the complete file. Which approach is the most reliable?

   • AManually concatenate the payloads of all packets in the order they were captured.
   • BDecrypt the TLS session first, then use 'Follow TCP Stream'.
   • CUse the HTTP object export feature without reassembling the TCP stream.
   • DUse Wireshark's 'Follow TCP Stream' and then export the reassembled data.
   Reveal Solution Discussion Select an answer first