A network analyst is investigating a suspected ARP spoofing attack. The analyst has a pcap of the local subnet. Which packet-level analysis would provide the strongest evidence of ARP spoofing?

Identify multiple ARP replies claiming the same IP address but with different MAC addresses.

Look for ARP packets with an unusual Ethernet type field.

Count the total number of ARP requests per second to detect a flood.

Check for ARP replies that are not preceded by an ARP request.

An analyst is dissecting a suspicious TCP stream and wants to systematically examine the protocol headers and payload. Which sequence of steps best represents a structured protocol analysis technique?

Only examine the IP header and ignore lower-layer headers

Decode the application-layer protocol without checking IP or TCP headers

Inspect the payload first, then decode the TCP header if needed

Decode Ethernet, IP, and TCP headers, then inspect payload content for anomalies

When analyzing a suspicious DNS query, which header field should an analyst examine first to determine whether the packet is a query or a response?

The QR (Query/Response) bit in the DNS flags field

The source and destination port numbers

During packet capture analysis, an analyst observes an HTTP request with a User-Agent string that contains a long sequence of '%00' characters and SQL keywords. Which attack signature is this most likely indicating?

Cross-site scripting (XSS) attempt

GIAC Security Operations Certified

Domain 2Objective 2

Protocol Attacks and Analysis GSOC Practice Questions (Page 4)

Part of the Network and Event Analysis domain, which makes up ~38% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~19–30 in this domain), expect 5–8 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 16–20

16application · medium
A network analyst is investigating a suspected ARP spoofing attack. The analyst has a pcap of the local subnet. Which packet-level analysis would provide the strongest evidence of ARP spoofing?
Select an answer first
17foundation · easy
An analyst is dissecting a suspicious TCP stream and wants to systematically examine the protocol headers and payload. Which sequence of steps best represents a structured protocol analysis technique?
Select an answer first
18foundation · easy
During packet analysis, an analyst notices a large number of ICMP Echo Request packets sent to a broadcast address, with the source IP address spoofed to appear as a victim host. The victim is not the actual sender. Which protocol attack is this an example of?
Select an answer first
19foundation · easy
When analyzing a suspicious DNS query, which header field should an analyst examine first to determine whether the packet is a query or a response?
Select an answer first
20foundation · easy
During packet capture analysis, an analyst observes an HTTP request with a User-Agent string that contains a long sequence of '%00' characters and SQL keywords. Which attack signature is this most likely indicating?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSOC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSOC” is a trademark of its owner, used for identification only.