GCIA Application Layer Protocol Analysis 2

Question 1

Which HTTP header is used by attackers in HTTP Host Header Injection attacks to redirect responses or poison web caches?

Accepted Answer

Host header

Answer

The HTTP Host header specifies the target virtual host; manipulating it can cause web cache poisoning or redirect server-generated URLs to attacker-controlled domains.

Question 2

What does a DNS response with a very low TTL (e.g., 0-60 seconds) for a domain suggest during threat analysis?

Accepted Answer

The domain may be using fast-flux DNS to rapidly rotate IP addresses for C2 or botnet infrastructure

Answer

Very low TTLs enable fast-flux DNS, where attacker-controlled domains rapidly rotate through many IP addresses to evade IP-based blacklisting and takedowns.

Question 3

In HTTP traffic, what is the significance of the 'Referer' header from an intrusion analysis perspective?

Accepted Answer

It can reveal the origin page of a request, helping analysts trace attack flows and identify phishing redirects

Answer

The Referer header shows the page that linked to the current request, enabling analysts to trace the attack chain, identify phishing landing pages, or spot CSRF attacks.

Question 4

An analyst identifies SMTP traffic where the HELO/EHLO command presents a hostname that doesn't match the sending mail server's IP via reverse DNS. What is the implication?

Accepted Answer

The server may be misconfigured, or it could indicate a spammer or attacker spoofing a legitimate mail server identity

Answer

A mismatch between HELO/EHLO hostname and reverse DNS is a common indicator of spam, phishing, or spoofed email sources since legitimate mail servers typically have matching forward and reverse DNS.

Question 5

What is HTTP pipelining abuse, and why is it relevant to intrusion analysts?

Accepted Answer

Sending multiple HTTP requests without waiting for responses, which can be abused to smuggle requests or bypass security controls

Answer

HTTP request smuggling exploits pipelining differences between front-end and back-end servers, allowing attackers to poison request queues, bypass security controls, or hijack other users' requests.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Application Layer Protocol Analysis 2