GCIA Network Protocols and Traffic Analysis

Question 1

Which of the following protocols is primarily used for secure web traffic?

Accepted Answer

HTTPS

Answer

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, which is the protocol for data transfer on the web. It uses SSL/TLS encryption to secure communication between a user's browser and a website, protecting data integrity and confidentiality. This makes HTTPS the primary and essential choice for secure web traffic, unlike HTTP, FTP, or Telnet which lack inherent encryption for this purpose.

Question 2

What does a TCP SYN scan primarily detect?

Accepted Answer

Open ports

Answer

A TCP SYN scan, also known as a half-open scan, is a common port scanning technique used to determine which ports on a target system are open and listening for connections. It sends a SYN packet and waits for a SYN/ACK response, but does not complete the three-way handshake. This method effectively identifies open services while being stealthier than a full TCP connect scan.

Question 3

In the context of network traffic analysis, what is the purpose of a protocol analyzer (such as Wireshark)?

Accepted Answer

To capture and analyze network packets

Answer

A protocol analyzer, such as Wireshark, is a powerful tool used in network traffic analysis to intercept and log data packets passing over a digital network. It allows security analysts to examine the contents of these packets, understand communication flows, diagnose network issues, and detect suspicious or malicious activity. By inspecting protocols and data at a granular level, it provides deep insights into network behavior.

Question 4

Which field in the IP header indicates the length of the packet?

Accepted Answer

Total Length

Answer

In the IP header, the 'Total Length' field specifies the entire length of the IP datagram, measured in bytes, including both the header and the data payload. This field is crucial for the receiving host to accurately determine the size of the incoming packet. It also helps in correctly reassembling fragmented packets if necessary, ensuring complete data delivery.

Question 5

Which of the following tools is commonly used to perform network traffic analysis and generate network flow statistics?

Accepted Answer

NetFlow

Answer

NetFlow is a network protocol developed by Cisco that collects IP traffic information as it enters or exits an interface. It provides detailed statistics about network conversations, such as source/destination IP addresses, ports, protocols, and byte counts. This flow data is invaluable for comprehensive network traffic analysis, security monitoring, and capacity planning, offering insights into network usage patterns.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Network Protocols and Traffic Analysis