Network Protocol Reverse Engineering GNFA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is examining a pcap from a compromised host. The traffic shows a TCP session to a remote server on port 443, but the TLS handshake does not complete. Instead, the client sends a single packet with a payload beginning with the bytes 'MZ' followed by binary data, and the server responds with a similar 'MZ' payload. The analyst suspects a custom protocol tunneling over the standard port. Which combination of observations most strongly supports this conclusion?

   • AThe payload begins with 'MZ' and the TCP session does not perform a TLS handshake, indicating the traffic is not actually TLS despite using port 443.
   • BThe 'MZ' bytes indicate a Windows executable is being transferred, so the session is a file download over HTTPS.
   • CThe traffic uses port 443, so it must be TLS regardless of the payload content.
   • DThe lack of a completed TLS handshake proves the traffic is malicious and part of a known malware family.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An analyst is monitoring a network that uses a custom protocol over UDP. The protocol normally has a fixed message size of 512 bytes. The analyst observes a series of packets from a single source to a single destination that are all 512 bytes, but the first byte of the payload alternates between 0x01 and 0x02 in a pattern that does not match the expected sequence. The analyst suspects a covert channel. Which of the following is the most likely explanation?

   • AThe alternating first byte is being used to encode hidden data by modulating a field that is otherwise constant or predictable.
   • BThe protocol has a bug that causes the first byte to flip randomly.
   • CThe packets are simply out of order, and the first byte is a sequence number that appears to alternate due to reordering.
   • DThe packets are from two different applications that are both using the same port.
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   An analyst is examining a pcap and sees a TCP session to port 22. The payload contains the string 'SSH-2.0-OpenSSH_8.9p1'. Which protocol is this traffic using?

   • AFile Transfer Protocol (FTP)
   • BSecure Shell (SSH)
   • CRemote Desktop Protocol (RDP)
   • DTelnet
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An analyst is reassembling a file transfer from a pcap that contains multiple TCP streams. The file was transferred using a custom protocol that splits the file into chunks and sends each chunk in a separate TCP connection. The analyst needs to reconstruct the original file. What is the most effective method?

   • AUse Wireshark's 'Follow TCP Stream' on each stream and manually combine the data
   • BReassemble each TCP stream individually and concatenate them in the order they appear in the pcap
   • CExtract the payloads from each stream and sort them by size
   • DIdentify the chunk order from the application-layer headers and reassemble the chunks in that order
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of session reassembly in network forensics?

   • ATo identify the source IP address of the attacker
   • BTo decrypt encrypted traffic
   • CTo compress the captured data for storage
   • DTo reconstruct the full application-layer exchange from captured packets
   Reveal Solution Discussion Select an answer first