A network engineer needs to send a custom Ethernet frame with a specific MAC address and an IP packet inside, to test a switch's MAC filtering. Using Scapy, which command correctly crafts and sends this frame?

sendp(IP(dst='10.0.0.1')/ICMP())

sendp(Ether(dst='aa:bb:cc:dd:ee:ff')/IP(dst='10.0.0.1')/ICMP())

send(IP(dst='10.0.0.1')/ICMP())

srp1(Ether(dst='aa:bb:cc:dd:ee:ff')/IP(dst='10.0.0.1')/ICMP())

A developer needs to build a TCP server that handles multiple clients concurrently. The server must read a line of text from each client, echo it back, and then close the connection. Which Python socket approach is most appropriate for this requirement?

Use a UDP socket and receive datagrams from multiple clients.

Use a single-threaded server that accepts one connection at a time and processes it fully before accepting the next.

Use threading to spawn a new thread for each client connection, reading a line and echoing it back.

Use a single socket and call recv() in a loop without accepting new connections.

Which Scapy function is used to capture network packets programmatically, and which parameter filters the capture by protocol or port?

listen() with the port parameter

sniff() with the filter parameter

readpcap() with the filter parameter

capture() with the protocol parameter

A security analyst needs to capture only DNS queries and responses on the corporate network for a 60-second window, then save them to a PCAP file for offline review. The analyst is writing a Python script using Scapy. Which approach meets the requirement?

Use sniff(filter='udp port 53', timeout=60) and then wrpcap('dns.pcap', packets)

Use sniff(count=60) and then wrpcap('dns.pcap', packets)

Use sniff(prn=lambda p: p.summary(), timeout=60) and then wrpcap('dns.pcap', packets)

Use sniff(filter='tcp port 53', timeout=60) and then wrpcap('dns.pcap', packets)

A forensic analyst has a large PCAP file (several GB) and needs to extract only the TCP payloads from HTTP requests to a specific server. The analyst wants to minimize memory usage. Which approach is most efficient?

Use PcapReader() to stream packets one at a time, filter for TCP port 80, and extract the Raw payload.

Use sniff(offline='file.pcap', filter='tcp port 80', prn=lambda p: p[Raw].load)

Use rdpcap() with a filter parameter to load only HTTP packets.

Use rdpcap() to load the entire file, then iterate through packets and extract payloads.

GIAC Python Coder

Domain 3Objective 3

Packet Analysis with Python GPYC Practice Questions (Page 3)

Part of the Network and Web Interaction domain, which makes up ~25% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 4–7 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

Questions 11–15

11application · medium
A network engineer needs to send a custom Ethernet frame with a specific MAC address and an IP packet inside, to test a switch's MAC filtering. Using Scapy, which command correctly crafts and sends this frame?
Select an answer first
12expert · hard
A developer needs to build a TCP server that handles multiple clients concurrently. The server must read a line of text from each client, echo it back, and then close the connection. Which Python socket approach is most appropriate for this requirement?
Select an answer first
13foundation · easy
Which Scapy function is used to capture network packets programmatically, and which parameter filters the capture by protocol or port?
Select an answer first
14application · medium
A security analyst needs to capture only DNS queries and responses on the corporate network for a 60-second window, then save them to a PCAP file for offline review. The analyst is writing a Python script using Scapy. Which approach meets the requirement?
Select an answer first
15expert · hard
A forensic analyst has a large PCAP file (several GB) and needs to extract only the TCP payloads from HTTP requests to a specific server. The analyst wants to minimize memory usage. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GPYC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GPYC” is a trademark of its owner, used for identification only.