GCIA Application Layer Protocol Analysis 3

Question 1

In TLS/HTTPS traffic analysis without full decryption, which field can still provide valuable threat intelligence to an analyst?

Accepted Answer

The TLS certificate's Subject/CN field, SANs, and the Server Name Indication (SNI) extension

Answer

The encrypted application data payload

Answer

The session ticket contents used for TLS resumption

Answer

The HMAC values used for message authentication

Question 2

What does the presence of 'CONNECT' method HTTP requests to unusual ports (e.g., 443, 8080) on a proxy tell an analyst?

Accepted Answer

The client is tunneling traffic through the HTTP proxy, potentially to bypass firewall restrictions

Answer

The client is performing a legitimate file upload to a web server

Answer

The proxy is enforcing HTTPS for all connections per security policy

Answer

The CONNECT method is used only for WebSocket upgrades and is benign

Question 3

An analyst sees SMB traffic with repeated authentication attempts using different usernames against multiple hosts across the network. What attack is underway?

Accepted Answer

Password spraying or brute-force attack against SMB authentication across multiple hosts

Answer

A Pass-the-Hash attack reusing NTLM hashes for lateral movement

Answer

An SMB relay attack intercepting and forwarding authentication challenges

Answer

Kerberoasting attempting to extract service ticket hashes from Active Directory

Question 4

What is the significance of HTTP response code 200 OK returned for a request to a URL that should return 404 Not Found, in the context of web application attacks?

Accepted Answer

This may indicate a successful exploitation of a path traversal or file inclusion vulnerability

Answer

The web server has been correctly updated with the new resource

Answer

HTTP servers always return 200 for all requests regardless of resource availability

Answer

The proxy is caching an old successful response for the URL

Question 5

In analyzing IRC traffic as part of botnet C2 investigation, what command is most significant when identifying infected hosts receiving instructions?

Accepted Answer

PRIVMSG commands directed at channel members containing encoded bot commands

Answer

NICK and USER commands establishing bot identity on the IRC server

Answer

JOIN commands indicating which channel the bot has connected to

Answer

PING/PONG keepalive messages maintaining the bot's connection

Question 6

What information does the HTTP 'X-Forwarded-For' header provide that is valuable during intrusion analysis?

Accepted Answer

The originating client IP address when traffic passes through proxies or load balancers

Answer

The cryptographic hash of the forwarded request for integrity verification

Answer

The geographic location of the requesting client determined by the proxy

Answer

The authentication token forwarded from an upstream identity provider

Question 7

An analyst notices HTTPS connections to a domain that has a valid certificate but the certificate was issued only hours ago. What threat does this suggest?

Accepted Answer

A phishing or malware campaign using a freshly registered domain with a quickly obtained certificate to appear legitimate

Answer

The organization is using automated certificate management (ACME) for legitimate domains

Answer

Certificate transparency logs require new certificates to appear fresh to validators

Answer

The domain recently migrated web hosting providers and needed a new certificate