During an incident investigation, an analyst has a pcap file that contains traffic from a compromised host. The analyst needs to determine whether the attacker exfiltrated data using HTTP POST requests. The pcap is large, and the analyst wants to quickly identify all HTTP POST requests and their payload sizes. Which approach is most efficient?

Use Wireshark's 'Export Objects' feature to extract all HTTP objects

Use tcpdump to filter for HTTP POST requests and count the packets

Use a tool like tshark to filter for HTTP requests with the POST method and display the content-length field

Use Wireshark's 'Follow TCP Stream' on each HTTP session to view the POST data

An analyst is reviewing a packet capture and sees an HTTP request with a Content-Length header that is much larger than the actual data in the packet. The request is to a web server. The analyst suspects an HTTP request smuggling attack. Which additional evidence would confirm this?

The request uses HTTP/1.1 instead of HTTP/1.0.

The presence of both Content-Length and Transfer-Encoding headers in the same request.

The request is sent to port 80 instead of 443.

The request has a large User-Agent header.

An analyst is investigating a potential data breach and has a pcap file. The analyst notices that a host is sending HTTP requests with a custom header 'X-Forwarded-For: 127.0.0.1' to a web server. The requests are to a login page. What is the most likely explanation?

The host is experiencing a network misconfiguration

The host is attempting to bypass IP-based access controls

The host is using a legitimate proxy server

The host is performing a SQL injection attack

GIAC Security Operations Certified

Domain 2Objective 1

Network Traffic Analysis GSOC Practice Questions (Page 6)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

5concepts

Questions 26–30

26foundation · easy
Which graphical tool is commonly used to capture and interactively analyze network packets, allowing deep inspection of individual frames?
Select an answer first
27expert · hard
During an incident investigation, an analyst has a pcap file that contains traffic from a compromised host. The analyst needs to determine whether the attacker exfiltrated data using HTTP POST requests. The pcap is large, and the analyst wants to quickly identify all HTTP POST requests and their payload sizes. Which approach is most efficient?
Select an answer first
28expert · medium
An analyst is reviewing a packet capture and sees an HTTP request with a Content-Length header that is much larger than the actual data in the packet. The request is to a web server. The analyst suspects an HTTP request smuggling attack. Which additional evidence would confirm this?
Select an answer first
29foundation · easy
Which protocol is used to resolve human-readable domain names to IP addresses?
Select an answer first
30expert · hard
An analyst is investigating a potential data breach and has a pcap file. The analyst notices that a host is sending HTTP requests with a custom header 'X-Forwarded-For: 127.0.0.1' to a web server. The requests are to a login page. What is the most likely explanation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.

Network Traffic Analysis GSOC Practice Questions (Page 6)

Questions 26–30

Which graphical tool is commonly used to capture and interactively analyze network packets, allowing deep inspection of individual frames?

An analyst is reviewing a packet capture and sees an HTTP request with a Content-Length header that is much larger than the actual data in the packet. The request is to a web server. The analyst suspects an HTTP request smuggling attack. Which additional evidence would confirm this?

Which protocol is used to resolve human-readable domain names to IP addresses?

An analyst is investigating a potential data breach and has a pcap file. The analyst notices that a host is sending HTTP requests with a custom header 'X-Forwarded-For: 127.0.0.1' to a web server. The requests are to a login page. What is the most likely explanation?

Keep studying — Network and Event Analysis