An analyst is reassembling a session from a pcap where the TCP stream has gaps due to packet loss. The analyst uses Wireshark's 'Follow TCP Stream' and sees a warning about missing data. What is the best next step?

Decode the payloads of the available packets to infer the missing data

Ignore the warning and proceed with the analysis because the missing data is likely insignificant

Use the sequence numbers to identify the missing segments and attempt to retrieve them from other captures or sources

Reassemble the session using only the packets that are present, without regard to order

An analyst is modeling the state machine of a custom protocol. The protocol has three states: INIT, ESTABLISHED, and TERMINATED. The analyst observes that a session goes from INIT to ESTABLISHED without receiving the expected handshake response. What does this indicate?

The analyst missed the handshake response in the capture

The protocol has a faster handshake than expected

The protocol is working correctly because the session is established

A protocol anomaly that may indicate a missing handshake or a malicious actor

In protocol analysis, what does an unexpected response code in an HTTP reply typically indicate?

The client is using a different protocol

A deviation from expected protocol behavior that may require investigation

A normal variation that can be ignored

An analyst encounters an HTTP response with a 'Content-Encoding: gzip' header. What must the analyst do to read the payload?

Decrypt the payload using a private key

Decompress the payload using gzip

An analyst is dissecting a custom protocol that uses a variable-length header. The first byte indicates the header length, followed by a 2-byte message type and a 4-byte payload length. The payload is compressed. The analyst has a pcap with multiple sessions and needs to extract the payloads for further analysis. What is the most efficient approach?

Export all packets as a raw binary file and use a hex editor to extract the payloads

Use Wireshark's built-in protocol dissector to automatically decode the payloads

Write a script to parse the header, extract the payload, and decompress it for each session

Manually follow each TCP stream and copy the payloads

GIAC Network Forensic Analyst

Domain 2Objective 2

Network Protocol Reverse Engineering GNFA Practice Questions (Page 5)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 21–25

21application · medium
An analyst is reassembling a session from a pcap where the TCP stream has gaps due to packet loss. The analyst uses Wireshark's 'Follow TCP Stream' and sees a warning about missing data. What is the best next step?
Select an answer first
22application · medium
An analyst is modeling the state machine of a custom protocol. The protocol has three states: INIT, ESTABLISHED, and TERMINATED. The analyst observes that a session goes from INIT to ESTABLISHED without receiving the expected handshake response. What does this indicate?
Select an answer first
23foundation · easy
In protocol analysis, what does an unexpected response code in an HTTP reply typically indicate?
Select an answer first
24foundation · easy
An analyst encounters an HTTP response with a 'Content-Encoding: gzip' header. What must the analyst do to read the payload?
Select an answer first
25expert · hard
An analyst is dissecting a custom protocol that uses a variable-length header. The first byte indicates the header length, followed by a 2-byte message type and a 4-byte payload length. The payload is compressed. The analyst has a pcap with multiple sessions and needs to extract the payloads for further analysis. What is the most efficient approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.