An analyst is monitoring network traffic and notices a large number of ICMP packets with varying payload sizes. The analyst wants to identify potential data exfiltration by examining ICMP payloads. Using Scapy, which approach is most effective?

Use a raw socket to capture only Ethernet frames and parse the ARP headers.

Capture ICMP packets and inspect the Raw layer payload for non-standard data patterns.

Capture all TCP packets and analyze the sequence numbers for anomalies.

Filter for UDP port 53 and analyze DNS queries for long subdomains.

GIAC Python Coder

Domain 3Objective 3

Packet Analysis with Python GPYC Practice Questions (Page 2)

Part of the Network and Web Interaction domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

Questions 6–10

6application · medium
An analyst is monitoring network traffic and notices a large number of ICMP packets with varying payload sizes. The analyst wants to identify potential data exfiltration by examining ICMP payloads. Using Scapy, which approach is most effective?
Select an answer first
7foundation · easy
In Scapy, which parameter of the sniff() function limits the number of packets captured before returning?
Select an answer first
8foundation · easy
Which socket method is used to bind a server socket to a specific address and port?
Select an answer first
9foundation · easy
In the requests library, which object maintains cookies across multiple HTTP requests?
Select an answer first
10foundation · easy
Which Scapy function sends a crafted packet at Layer 2 (Ethernet) without waiting for a response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPYC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPYC” is a trademark of its owner, used for identification only.

Packet Analysis with Python GPYC Practice Questions (Page 2)

Questions 6–10

An analyst is monitoring network traffic and notices a large number of ICMP packets with varying payload sizes. The analyst wants to identify potential data exfiltration by examining ICMP payloads. Using Scapy, which approach is most effective?

In Scapy, which parameter of the sniff() function limits the number of packets captured before returning?

Which socket method is used to bind a server socket to a specific address and port?

In the requests library, which object maintains cookies across multiple HTTP requests?

Which Scapy function sends a crafted packet at Layer 2 (Ethernet) without waiting for a response?

Keep studying — Network and Web Interaction