A network analyst is monitoring a custom protocol that uses a fixed-length header with a 1-byte message type field. The protocol specification defines message types 0x01 through 0x05. The analyst observes a packet with message type 0x7F. What is the most appropriate initial action?

Update the protocol specification to include the new message type

Assume the packet is from a different protocol and filter it out

Flag the packet as a protocol anomaly and investigate further

Ignore the packet because it is likely a false positive

While analyzing a pcap, an analyst notices a series of UDP packets to port 12345. Each packet has a 4-byte header: the first byte is always 0x01, the second byte increments from 0x00 to 0xFF and then wraps, and the last two bytes appear to be a little-endian length field. The payload length matches the length field. What is the most likely purpose of the second byte?

It is a sequence number used to detect packet loss or reordering.

It is a protocol version number that increments with each new release.

It is a message type identifier that cycles through different command types.

It is a checksum used to verify the integrity of the payload.

An analyst is modeling the state machine of a custom protocol used by a botnet. The protocol has states: IDLE, CONNECTING, ESTABLISHED, and COMMAND. The analyst observes that a bot goes from IDLE to COMMAND without entering ESTABLISHED. The traffic shows a single packet from the bot to the server with a command payload. What is the most likely explanation?

The bot is compromised and sending commands to the server

The protocol has been updated to allow direct command transmission

The bot is using a fast reconnection mechanism that bypasses the normal handshake, which is a protocol anomaly

The analyst missed the ESTABLISHED state because it was not captured

Which of the following is an example of a protocol anomaly that might indicate malicious activity?

A TCP packet with both SYN and FIN flags set

A TCP three-way handshake completing successfully

A normal DNS query for a legitimate domain

An HTTP GET request to a web server

GIAC Network Forensic Analyst

Domain 2Objective 2

Network Protocol Reverse Engineering GNFA Practice Questions (Page 8)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A network analyst is monitoring a custom protocol that uses a fixed-length header with a 1-byte message type field. The protocol specification defines message types 0x01 through 0x05. The analyst observes a packet with message type 0x7F. What is the most appropriate initial action?
Select an answer first
37application · medium
While analyzing a pcap, an analyst notices a series of UDP packets to port 12345. Each packet has a 4-byte header: the first byte is always 0x01, the second byte increments from 0x00 to 0xFF and then wraps, and the last two bytes appear to be a little-endian length field. The payload length matches the length field. What is the most likely purpose of the second byte?
Select an answer first
38expert · hard
An analyst is modeling the state machine of a custom protocol used by a botnet. The protocol has states: IDLE, CONNECTING, ESTABLISHED, and COMMAND. The analyst observes that a bot goes from IDLE to COMMAND without entering ESTABLISHED. The traffic shows a single packet from the bot to the server with a command payload. What is the most likely explanation?
Select an answer first
39foundation · easy
Which of the following is an example of a protocol anomaly that might indicate malicious activity?
Select an answer first
40foundation · easy
When reconstructing a TCP session from captured packets, which field is used to order the segments correctly?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.

Network Protocol Reverse Engineering GNFA Practice Questions (Page 8)

Questions 36–40

A network analyst is monitoring a custom protocol that uses a fixed-length header with a 1-byte message type field. The protocol specification defines message types 0x01 through 0x05. The analyst observes a packet with message type 0x7F. What is the most appropriate initial action?

Which of the following is an example of a protocol anomaly that might indicate malicious activity?

When reconstructing a TCP session from captured packets, which field is used to order the segments correctly?

Keep studying — Network Traffic Analysis and Visualization