An analyst is reverse engineering an unknown protocol. The analyst notices that the first 2 bytes of every packet are the same, but the rest of the payload varies. What is the most likely interpretation of these constant bytes?

A magic number or protocol identifier

When reverse engineering a custom protocol, which technique is used to identify repeating patterns in the payload that may represent fields or commands?

Changing the protocol's port number

Deleting packets to simplify the capture

Statistical analysis of byte frequencies

A forensic analyst is examining traffic from a compromised host that communicates with a known C2 server. The traffic uses TCP port 443, but the payloads do not resemble TLS. The sessions are short-lived, lasting only a few seconds, and occur every 5 minutes. The payloads have a consistent structure: a 2-byte length field followed by data that appears to be base64-encoded. The analyst needs to determine if this is a custom protocol or a misidentified standard protocol. Which approach is most effective?

Assume it is TLS because it uses port 443 and attempt to decrypt it with the server's private key

Analyze the payload structure and behavioral pattern to determine if it matches any known protocol, and treat it as a custom protocol if no match is found

Use a protocol analyzer to automatically identify the protocol and trust its output

Ignore the traffic because it is on a standard port and likely benign

An analyst is reviewing a pcap and sees a TCP session to port 6667. The payload contains the string 'PRIVMSG #channel :hello'. Which protocol is this traffic most likely using?

Hypertext Transfer Protocol (HTTP)

Simple Mail Transfer Protocol (SMTP)

GIAC Network Forensic Analyst

Domain 2Objective 2

Network Protocol Reverse Engineering GNFA Practice Questions (Page 9)

Part of the Network Traffic Analysis and Visualization domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~19–32 in this domain), expect 10–16 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

7concepts

Questions 41–45

41application · medium
An analyst is reverse engineering an unknown protocol. The analyst notices that the first 2 bytes of every packet are the same, but the rest of the payload varies. What is the most likely interpretation of these constant bytes?
Select an answer first
42foundation · easy
In a typical TCP connection, what is the correct sequence of flags exchanged during the three-way handshake?
Select an answer first
43foundation · easy
When reverse engineering a custom protocol, which technique is used to identify repeating patterns in the payload that may represent fields or commands?
Select an answer first
44expert · hard
A forensic analyst is examining traffic from a compromised host that communicates with a known C2 server. The traffic uses TCP port 443, but the payloads do not resemble TLS. The sessions are short-lived, lasting only a few seconds, and occur every 5 minutes. The payloads have a consistent structure: a 2-byte length field followed by data that appears to be base64-encoded. The analyst needs to determine if this is a custom protocol or a misidentified standard protocol. Which approach is most effective?
Select an answer first
45application · easy
An analyst is reviewing a pcap and sees a TCP session to port 6667. The payload contains the string 'PRIVMSG #channel :hello'. Which protocol is this traffic most likely using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GNFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GNFA” is a trademark of its owner, used for identification only.