GCIA Application Layer Protocol Analysis 3

Question 1

In TLS/HTTPS traffic analysis without full decryption, which field can still provide valuable threat intelligence to an analyst?

Accepted Answer

The TLS certificate's Subject/CN field, SANs, and the Server Name Indication (SNI) extension

Answer

Even without decrypting TLS, analysts can inspect SNI (plaintext hostname), certificate details, and JA3/JA3S fingerprints to identify malware C2 communications or suspicious domains.

Question 2

What does the presence of 'CONNECT' method HTTP requests to unusual ports (e.g., 443, 8080) on a proxy tell an analyst?

Accepted Answer

The client is tunneling traffic through the HTTP proxy, potentially to bypass firewall restrictions

Answer

HTTP CONNECT is used to create a tunnel through a proxy; attackers abuse it to tunnel SSH, C2 traffic, or other protocols through web proxies to bypass firewall rules.

Question 3

An analyst sees SMB traffic with repeated authentication attempts using different usernames against multiple hosts across the network. What attack is underway?

Accepted Answer

Password spraying or brute-force attack against SMB authentication across multiple hosts

Answer

Repeated SMB authentication attempts with varied usernames across many hosts is characteristic of a password spraying or automated credential brute-force campaign targeting network file shares.

Question 4

What is the significance of HTTP response code 200 OK returned for a request to a URL that should return 404 Not Found, in the context of web application attacks?

Accepted Answer

This may indicate a successful exploitation of a path traversal or file inclusion vulnerability

Answer

A 200 response to a path that normally returns 404 can indicate successful path traversal, LFI, or RFI exploitation where the attacker accessed an unintended file or resource.

Question 5

In analyzing IRC traffic as part of botnet C2 investigation, what command is most significant when identifying infected hosts receiving instructions?

Accepted Answer

PRIVMSG commands directed at channel members containing encoded bot commands

Answer

PRIVMSG (private message) is the primary channel through which bot operators issue encoded commands to infected hosts in IRC-based botnets, making it the most critical command to analyze.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Application Layer Protocol Analysis 3