GCIA Application Layer Protocol Analysis

Question 1

An analyst observes HTTP traffic where the User-Agent string contains 'Mozilla/4.0 (compatible; MSIE 6.0)' in 2024. What is the most likely concern?

Accepted Answer

Potential malware or attacker tool using an outdated spoofed User-Agent

Answer

IE 6.0 is extremely outdated and its User-Agent is commonly spoofed by malware or attacker toolkits to blend in with older traffic baselines.

Question 2

Which DNS record type is most commonly abused in DNS amplification DDoS attacks?

Accepted Answer

ANY or TXT record

Answer

ANY and TXT queries return large responses relative to the request size, making them ideal for amplification attacks where the attacker spoofs the victim's IP as the source.

Question 3

In HTTP, what does a 301 response code indicate that is relevant to intrusion analysts?

Accepted Answer

The resource has been permanently moved to a new URL

Answer

A 301 Permanent Redirect can be used by attackers to silently redirect victims to malicious sites, making it important for analysts to inspect redirect chains.

Question 4

An analyst captures SMTP traffic and sees the command 'RCPT TO:<user@domain.com>' repeated hundreds of times to different addresses. What attack is most likely occurring?

Accepted Answer

SMTP relay open exploitation for spam or phishing distribution

Answer

Hundreds of RCPT TO commands cycling through different recipients is a classic indicator of an open relay being abused to send spam or phishing emails.

Question 5

What is DNS tunneling, and how is it typically detected in network traffic?

Accepted Answer

Encoding data within DNS queries and responses to exfiltrate data; detected by abnormally long or high-frequency DNS queries

Answer

DNS tunneling encodes C2 or exfiltrated data in DNS query/response payloads; analysts detect it by looking for unusually long subdomain labels, high query frequency, or large TXT record responses.

(GCIA) GIAC Certified Intrusion Analyst Practice Test

(GCIA) GIAC Certified Intrusion Analyst Practice Test

GCIA Application Layer Protocol Analysis