GCIA Application Layer Protocol Analysis

Question 1

An analyst observes HTTP traffic where the User-Agent string contains 'Mozilla/4.0 (compatible; MSIE 6.0)' in 2024. What is the most likely concern?

Accepted Answer

Potential malware or attacker tool using an outdated spoofed User-Agent

Answer

Normal browser traffic from an older Windows XP system

Answer

A legitimate mobile browser on a legacy device

Answer

A web crawler from a major search engine

Question 2

Which DNS record type is most commonly abused in DNS amplification DDoS attacks?

Accepted Answer

ANY or TXT record

Answer

A record

Answer

MX record

Answer

CNAME record

Question 3

In HTTP, what does a 301 response code indicate that is relevant to intrusion analysts?

Accepted Answer

The resource has been permanently moved to a new URL

Answer

The server requires authentication before serving the resource

Answer

The request succeeded and a new resource was created

Answer

The server is temporarily unavailable

Question 4

An analyst captures SMTP traffic and sees the command 'RCPT TO:<user@domain.com>' repeated hundreds of times to different addresses. What attack is most likely occurring?

Accepted Answer

SMTP relay open exploitation for spam or phishing distribution

Answer

A brute-force attack against mail server credentials

Answer

A directory traversal attack against the mail server

Answer

DNS poisoning targeting mail exchange records

Question 5

What is DNS tunneling, and how is it typically detected in network traffic?

Accepted Answer

Encoding data within DNS queries and responses to exfiltrate data; detected by abnormally long or high-frequency DNS queries

Answer

Encrypting DNS traffic using TLS; detected by certificate inspection

Answer

Redirecting DNS traffic through a proxy; detected by unusual TTL values

Answer

Spoofing DNS responses to redirect traffic; detected by DNSSEC validation failures

Question 6

In FTP traffic analysis, what does the presence of PORT command usage (active mode) versus PASV (passive mode) indicate to a network analyst?

Accepted Answer

Active mode uses the server to initiate the data connection back to the client; passive mode has the client connect to the server for data

Answer

Active mode means the client is acting as the server for the data connection; passive mode means the server initiates the data connection

Answer

Both modes are identical in terms of connection direction and present no analytical difference

Answer

Active mode is encrypted while passive mode transmits in cleartext

Question 7

An analyst sees HTTP POST requests to /login.php with an unusually high volume of different password values in rapid succession. What is the most likely attack?

Accepted Answer

HTTP credential brute-force or credential stuffing attack

Answer

SQL injection targeting the authentication database

Answer

Cross-site request forgery exploiting the login endpoint

Answer

Path traversal attempting to access /etc/passwd