GCIA Application Layer Protocol Analysis 2

Question 1

Which HTTP header is used by attackers in HTTP Host Header Injection attacks to redirect responses or poison web caches?

Accepted Answer

Host header

Answer

Content-Type header

Answer

Authorization header

Answer

Accept-Encoding header

Question 2

What does a DNS response with a very low TTL (e.g., 0-60 seconds) for a domain suggest during threat analysis?

Accepted Answer

The domain may be using fast-flux DNS to rapidly rotate IP addresses for C2 or botnet infrastructure

Answer

The domain is part of a content delivery network requiring frequent updates

Answer

The DNS server is misconfigured and should be reported to the administrator

Answer

Low TTL values are standard practice and present no security concern

Question 3

In HTTP traffic, what is the significance of the 'Referer' header from an intrusion analysis perspective?

Accepted Answer

It can reveal the origin page of a request, helping analysts trace attack flows and identify phishing redirects

Answer

It is used only for caching purposes and has no security relevance

Answer

It is only present in HTTPS traffic and helps validate certificate chains

Answer

It authenticates the client to the server using a shared secret

Question 4

An analyst identifies SMTP traffic where the HELO/EHLO command presents a hostname that doesn't match the sending mail server's IP via reverse DNS. What is the implication?

Accepted Answer

The server may be misconfigured, or it could indicate a spammer or attacker spoofing a legitimate mail server identity

Answer

This is a normal configuration that indicates the server uses a load balancer

Answer

HELO/EHLO hostname must always match PTR records per RFC; this connection will always be rejected

Answer

This indicates the email is encrypted with STARTTLS

Question 5

What is HTTP pipelining abuse, and why is it relevant to intrusion analysts?

Accepted Answer

Sending multiple HTTP requests without waiting for responses, which can be abused to smuggle requests or bypass security controls

Answer

Using multiple HTTP connections simultaneously to DDoS a web server

Answer

Encrypting HTTP traffic to evade deep packet inspection systems

Answer

Compressing HTTP responses to reduce detection by anomaly-based IDS

Question 6

When analyzing DNS traffic, what does a high volume of NXDOMAIN (non-existent domain) responses indicate?

Accepted Answer

Possible domain generation algorithm (DGA) malware attempting to contact its C2 server

Answer

Normal browsing behavior as users frequently mistype URLs

Answer

A DNS server that is overloaded and unable to resolve legitimate queries

Answer

An attacker performing DNS cache poisoning against the local resolver

Question 7

An analyst observes HTTP traffic with chunked transfer encoding where the chunk sizes are inconsistent with the actual data being sent. What attack technique does this suggest?

Accepted Answer

HTTP request smuggling exploiting inconsistencies in Transfer-Encoding parsing between proxy layers

Answer

HTTP response splitting used to inject malicious headers into cached responses

Answer

A man-in-the-middle attack modifying chunk sizes to corrupt data integrity

Answer

A buffer overflow attempt targeting the HTTP parsing engine of the web server