GIAC Certification — Questions and Answers

Question 1: When analyzing a pcap, an analyst finds packets with the URG flag set and data in the urgent pointer field. In an attack context, this technique is often used to:

Establish an authenticated management session
Fragment packets below the IDS reassembly threshold
Evade IDS inspection by placing shellcode in the urgent data region (Correct answer)
Perform a half-open port scan

Correct answer: Evade IDS inspection by placing shellcode in the urgent data region

Some legacy IDS implementations do not inspect TCP urgent data, allowing attackers to embed malicious payloads there to evade detection.

Question 2: A threat actor uses 'living-off-the-land' techniques. Which of the following BEST describes this approach?

Deploying custom kernel rootkits to evade AV detection
Using physical access to install hardware keyloggers
Exfiltrating data over encrypted DNS tunnels
Abusing legitimate system tools like PowerShell and WMI to execute malicious actions (Correct answer)

Correct answer: Abusing legitimate system tools like PowerShell and WMI to execute malicious actions

Living-off-the-land (LotL) attacks leverage built-in OS tools such as PowerShell, WMI, certutil, and mshta to blend in with normal activity and evade detection.

Question 3: An attacker sends a crafted TCP packet with both SYN and FIN flags set. What is the likely purpose?

OS fingerprinting or firewall evasion (Correct answer)
Establishing a legitimate connection
Triggering a buffer overflow
Performing a DDoS amplification attack

Correct answer: OS fingerprinting or firewall evasion

Simultaneous SYN/FIN flags are illegal in normal TCP and are commonly used in Nmap scans to identify OS types or probe firewall rule behavior.

Question 4: What distinguishes a 'beaconing' behavior pattern in network traffic that would indicate C2 communication?

DNS queries returning NXDOMAIN responses repeatedly
Periodic outbound connections at regular intervals to the same destination (Correct answer)
Large, single data transfers to external IPs during business hours
High-volume UDP traffic to random destination ports

Correct answer: Periodic outbound connections at regular intervals to the same destination

C2 beaconing is characterized by regular, periodic outbound connections (e.g., every 60 seconds) that indicate malware checking in with its command-and-control server.

Question 5: Which protocol does IPsec use in Transport Mode to provide data integrity and authentication without encryption?

AH (Authentication Header) (Correct answer)
GRE (Generic Routing Encapsulation)
ESP (Encapsulating Security Payload)
IKE (Internet Key Exchange)

Correct answer: AH (Authentication Header)

AH provides data integrity and origin authentication for IP packets but does not encrypt the payload; ESP provides both confidentiality and optional authentication.

Question 6: A GCIA analyst reviewing NetFlow data sees a single internal host making brief connections to hundreds of external IPs on port 6667. What is the most probable explanation?

The host is running a peer-to-peer file-sharing application
The host is sending spam email through open relays
The host is performing a legitimate network inventory scan
The host is part of an IRC-based botnet receiving commands (Correct answer)

Correct answer: The host is part of an IRC-based botnet receiving commands

Port 6667 is the default IRC port; many legacy botnets use IRC as a command-and-control channel, and connections to numerous C2 nodes manifest as brief multi-destination flows.

Question 7: A penetration tester discovers a web application reflects user input directly in the page response. Which vulnerability class does this most likely represent?

Directory Traversal
CSRF
Cross-Site Scripting (XSS) (Correct answer)
SQL Injection

Correct answer: Cross-Site Scripting (XSS)

When unsanitized user input is echoed back in the HTML response, it enables XSS attacks where malicious scripts can execute in the victim's browser.

Question 8: An attacker performs DNS cache poisoning. What is the MOST likely goal of this attack?

Decrypting TLS-encrypted DNS queries
Causing a denial-of-service by flooding the DNS resolver
Enumerating all hostnames in a target DNS zone
Redirecting users to malicious servers by inserting fraudulent DNS records (Correct answer)

Correct answer: Redirecting users to malicious servers by inserting fraudulent DNS records

DNS cache poisoning inserts forged DNS records into a resolver's cache so that subsequent queries return attacker-controlled IP addresses, enabling phishing or MITM attacks.

Question 9: When conducting network traffic analysis, which technique do attackers use to hide C2 communications within seemingly legitimate web traffic on port 80/443?

ARP poisoning over standard web ports
Domain fronting and HTTP/S-based C2 beaconing (Correct answer)
SYN flooding on HTTPS endpoints
VLAN hopping using 802.1Q tags on port 80

Correct answer: Domain fronting and HTTP/S-based C2 beaconing

Domain fronting routes C2 traffic through trusted CDN providers, making malicious beacons appear as legitimate HTTPS traffic to deep-packet inspection devices.

Question 10: During incident response, which phase involves containing the threat to prevent further damage?

Recovery
Containment (Correct answer)
Eradication
Identification

Correct answer: Containment

The Containment phase focuses on limiting the spread and impact of an incident—such as isolating infected hosts—before moving to removing the root cause in Eradication.

Question 11: An analyst reviewing Sysmon logs notices Event ID 3 generated by 'lsass.exe' making an outbound network connection. Why is this significant?

LSASS should not initiate outbound network connections and this may indicate credential theft or C2 activity (Correct answer)
Event ID 3 only logs DNS queries and is not security relevant
LSASS routinely makes outbound connections for license validation
LSASS making network connections is normal Kerberos authentication behavior

Correct answer: LSASS should not initiate outbound network connections and this may indicate credential theft or C2 activity

LSASS (Local Security Authority Subsystem Service) handles authentication locally and should never initiate outbound network connections, so this is a strong indicator of compromise.

Question 12: An organization wants to ensure that no single employee can complete a sensitive financial transaction alone. Which security principle does this implement?

Need to know
Least privilege
Defense in depth
Separation of duties (Correct answer)

Correct answer: Separation of duties

Separation of duties divides critical tasks among multiple people to prevent fraud or error by ensuring no single individual controls an entire sensitive process.

Question 13: When conducting network forensics, an analyst captures traffic and notices TLS-encrypted sessions to an unusual port (4444). What is the MOST appropriate next step?

Decrypt the traffic using the server's private key
Immediately block the destination IP at the firewall
Analyze JA3 fingerprints and certificate details to identify the TLS client/server (Correct answer)
Assume the traffic is benign since it uses encryption

Correct answer: Analyze JA3 fingerprints and certificate details to identify the TLS client/server

JA3 fingerprinting extracts TLS handshake parameters to create a hash that can identify specific malware families or C2 frameworks even without decrypting the traffic.

Question 14: Which Kerberos ticket is issued first and used to obtain service tickets?

Session Key Token
Ticket Granting Ticket (TGT) (Correct answer)
Service Ticket (ST)
Privilege Attribute Certificate (PAC)

Correct answer: Ticket Granting Ticket (TGT)

The TGT is issued by the Authentication Server (AS) during initial login and is presented to the Ticket Granting Service (TGS) to obtain service-specific tickets.

Question 15: What is the significance of detecting a large number of ICMP 'Echo Request' packets of unusual size (e.g., 65,000 bytes) targeting a single host?

It indicates a legitimate network throughput test
It may indicate a Ping of Death or ICMP flood denial-of-service attempt (Correct answer)
It is normal ICMP keep-alive behavior for large networks
It is a sign of OSPF route advertisements

Correct answer: It may indicate a Ping of Death or ICMP flood denial-of-service attempt

Oversized ICMP echo requests can crash unpatched systems (Ping of Death) or be used for ICMP flood DoS; both are relevant intrusion indicators.

Question 16: What is the primary purpose of a 'lessons learned' meeting held after an incident is resolved?

To satisfy regulatory reporting requirements
To identify process improvements and update IR procedures to prevent recurrence (Correct answer)
To assign blame and discipline responsible employees
To document attacker attribution for law enforcement

Correct answer: To identify process improvements and update IR procedures to prevent recurrence

Post-incident lessons learned sessions focus on improving detection, response processes, and security controls to reduce the impact of future incidents.

Question 17: During malware analysis, a sample is observed making calls to VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread targeting another process. What technique is indicated?

Reflective DLL injection
Classic remote process injection (shellcode injection) (Correct answer)
Process hollowing of a suspended process
DLL hijacking via search order manipulation

Correct answer: Classic remote process injection (shellcode injection)

The sequence VirtualAllocEx → WriteProcessMemory → CreateRemoteThread is the canonical Windows API pattern for injecting shellcode into a remote process.

Question 18: Which hashing algorithm produces a 256-bit digest and is part of the SHA-2 family?

SHA-256 (Correct answer)
RIPEMD-128
SHA-1
MD5

Correct answer: SHA-256

SHA-256 is a member of the SHA-2 family producing a 256-bit (32-byte) hash digest, and is widely used for digital signatures, certificates, and data integrity verification.

Question 19: What does the concept of 'data at rest' encryption primarily protect against?

Man-in-the-middle attacks on network traffic
SQL injection against database queries
Session hijacking after authentication
Unauthorized access to stored data from physical theft or improper disposal (Correct answer)

Correct answer: Unauthorized access to stored data from physical theft or improper disposal

Encrypting data at rest protects stored files and databases so that even if storage media is stolen, lost, or improperly decommissioned, the data remains unreadable.

Question 20: An organization discovers that an attacker has been present in their network for 6 months. What term describes this type of intrusion?

Distributed Denial of Service (DDoS)
Opportunistic smash-and-grab attack
Advanced Persistent Threat (APT) (Correct answer)
Script kiddie attack

Correct answer: Advanced Persistent Threat (APT)

Advanced Persistent Threats (APTs) are characterized by long dwell times, targeted objectives, and sophisticated tradecraft to maintain persistent access without detection.

Question 21: What is the primary purpose of a DMZ (demilitarized zone) in network architecture?

To perform deep packet inspection on all outbound traffic
To provide redundant routing paths for critical systems
To host public-facing services while isolating the internal network (Correct answer)
To encrypt traffic between internal hosts

Correct answer: To host public-facing services while isolating the internal network

A DMZ places internet-facing servers (web, mail, DNS) in a separate segment so that if they are compromised, the internal network remains protected.

Question 22: Which wireless attack captures the 4-way WPA2 handshake to perform offline password cracking?

Evil twin attack
Deauthentication + handshake capture (Correct answer)
Beacon flooding
KRACK attack

Correct answer: Deauthentication + handshake capture

By sending forged deauthentication frames to force a client to reconnect, an attacker captures the WPA2 4-way handshake and then brute-forces the passphrase offline.

Question 23: In the context of PKI, what does a Certificate Revocation List (CRL) contain?

Public keys of all issued certificates
A log of all certificate signing requests
Serial numbers of certificates that have been revoked before expiration (Correct answer)
A list of trusted root CAs approved by NIST

Correct answer: Serial numbers of certificates that have been revoked before expiration

A CRL is a time-stamped list published by a CA containing serial numbers of certificates that have been revoked and should no longer be trusted.

Question 24: What is the primary function of a stateful packet inspection (SPI) firewall compared to a stateless packet filter?

SPI encrypts traffic between hosts; stateless filters do not
SPI tracks the state of TCP connections and validates packets against expected flow (Correct answer)
SPI performs application-layer content inspection; stateless filters only check IPs
SPI requires user authentication; stateless filters operate without credentials

Correct answer: SPI tracks the state of TCP connections and validates packets against expected flow

A stateful firewall maintains a connection state table and only allows packets that match an established, legitimate session, blocking unsolicited inbound packets that a stateless filter might pass.

Question 25: What is the primary purpose of the 'pass' rule action in Snort?

To log the packet without generating an alert
To ignore packets that match the rule and stop further processing (Correct answer)
To forward the packet to a secondary sensor
To block and reset the connection

Correct answer: To ignore packets that match the rule and stop further processing

A Snort 'pass' rule causes matching packets to be silently allowed and stops further rule evaluation for those packets, often used to whitelist trusted traffic.

Question 26: Which Windows artifact stores evidence of USB devices that were previously connected to a system, including device serial numbers?

HKLM\SYSTEM\CurrentControlSet\Services\usbstor
C:\Windows\inf\setupapi.dev.log
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR (Correct answer)

Correct answer: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum stores entries for every USB storage device connected, including manufacturer, model, and serial number.

Question 27: A packet shows an IP header length (IHL) field of 6 (i.e., 24 bytes). What does this indicate?

The payload is 24 bytes long
The TTL value is 24
IP options are present in the header (Correct answer)
The packet is fragmented

Correct answer: IP options are present in the header

An IHL greater than 5 (the standard 20-byte header) means IP options fields are present, which can be abused for source routing or IDS evasion techniques.

Question 28: Which RAID level provides disk striping with parity distributed across all drives, requiring at least 3 disks?

RAID 5 (Correct answer)
RAID 1
RAID 10
RAID 0

Correct answer: RAID 5

RAID 5 stripes data and distributes parity information across all member drives, allowing recovery from a single drive failure with efficient storage use.

Question 29: An analyst observes DNS queries for very long, random-looking subdomains such as 'aGVsbG8gd29ybGQ.evil.com'. What attack technique does this most likely represent?

DNS cache poisoning
DNS tunneling for data exfiltration (Correct answer)
Fast-flux domain generation
DNS amplification DDoS attack

Correct answer: DNS tunneling for data exfiltration

DNS tunneling encodes data (often base64) into subdomain labels to exfiltrate information through DNS queries, which frequently bypass egress firewalls.

Question 30: A packet capture shows many TCP RST packets being sent immediately after SYN packets to various ports on a host. This pattern most likely indicates:

A UDP port scan
An ICMP sweep
A TCP connect scan
A TCP SYN scan (nmap -sS) (Correct answer)

Correct answer: A TCP SYN scan (nmap -sS)

A stealth SYN scan generates RST responses from closed ports and drops the connection on open ports, producing the observed RST burst pattern.

Question 31: Which field in an IP header is used to detect and prevent packet fragmentation reassembly attacks in an IDS?

Identification field and fragment offset (Correct answer)
Protocol field
Time to Live (TTL)
Differentiated Services Code Point (DSCP)

Correct answer: Identification field and fragment offset

The Identification field links fragments and the Fragment Offset field orders them; IDS rules that track these fields detect overlapping or malformed fragment reassembly exploits.

Question 32: In Wireshark, which display filter would show only TCP packets where the SYN flag is set but the ACK flag is NOT set?

tcp.handshake == true
tcp.flags == 0x02
tcp.flags.syn == 1
tcp.flags.syn == 1 && tcp.flags.ack == 0 (Correct answer)

Correct answer: tcp.flags.syn == 1 && tcp.flags.ack == 0

The filter 'tcp.flags.syn == 1 && tcp.flags.ack == 0' isolates initial SYN packets (not SYN-ACKs), useful for spotting connection-initiation anomalies.

GIAC Certification

GIAC (Global Information Assurance Certification) certifications validate cybersecurity skills across domains including intrusion analysis, digital forensics, penetration testing, cloud security, and malware analysis. Exams are proctored and open-book, testing both theoretical knowledge and practical application.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

giac.org — Test delivery, exam format, passing score, time limit, renewal, retake policy, test dates, exam information · verified Nov 2026