GIAC Certification — Questions and Answers

Question 1: In the TCP three-way handshake, which flag combination correctly describes the second packet sent by the server?

SYN + ACK (Correct answer)
ACK only
FIN + ACK
SYN only

Correct answer: SYN + ACK

The server responds to the client's SYN with a SYN-ACK packet, acknowledging the client's sequence number and advertising its own initial sequence number.

Question 2: An analyst sees repeated outbound HTTPS connections from one workstation to the same external IP at exactly 60-second intervals. This behavior is most consistent with:

Scheduled NTP synchronization
Standard browser certificate revocation checks
Malware beaconing with a fixed callback interval (Correct answer)
Normal Windows Update check-in traffic

Correct answer: Malware beaconing with a fixed callback interval

Precisely timed, regular outbound connections are a classic indicator of malware beaconing, where the implant checks in with its C2 server on a fixed schedule.

Question 3: An analyst reviewing log files notices HTTP responses with status code 200 but the response body contains the string 'Access Denied'. What threat does this potentially indicate?

An application-layer bypass where the web app returns errors inside a 200 OK envelope (Correct answer)
Normal HTTP redirect behavior
A successful SQL injection exfiltration
A reflected XSS attack payload in the response

Correct answer: An application-layer bypass where the web app returns errors inside a 200 OK envelope

Some web applications return HTTP 200 with error text in the body, which can indicate misconfigurations that allow partial access or that attackers are probing application logic.

Question 4: What is the purpose of establishing a 'chain of custody' during digital forensic evidence collection?

To document every person who handled evidence and all actions taken, ensuring admissibility (Correct answer)
To create a duplicate copy of evidence for backup purposes
To encrypt evidence to prevent unauthorized access
To prioritize which evidence to collect first based on volatility

Correct answer: To document every person who handled evidence and all actions taken, ensuring admissibility

Chain of custody documentation tracks every handler and action applied to evidence, establishing its integrity and authenticity for legal admissibility.

Question 5: What is the primary function of a stateful packet inspection (SPI) firewall compared to a stateless packet filter?

SPI tracks the state of TCP connections and validates packets against expected flow (Correct answer)
SPI encrypts traffic between hosts; stateless filters do not
SPI performs application-layer content inspection; stateless filters only check IPs
SPI requires user authentication; stateless filters operate without credentials

Correct answer: SPI tracks the state of TCP connections and validates packets against expected flow

A stateful firewall maintains a connection state table and only allows packets that match an established, legitimate session, blocking unsolicited inbound packets that a stateless filter might pass.

Question 6: Which social engineering technique involves an attacker calling a target while posing as IT support or another trusted entity?

Vishing (Correct answer)
Phishing
Smishing
Pretexting via email

Correct answer: Vishing

Vishing (voice phishing) uses phone calls to manipulate targets into revealing credentials or sensitive information by impersonating helpdesk staff, banks, or authorities.

Question 7: During containment of a ransomware incident, which action should be performed FIRST?

Wipe and reimage all affected systems
Isolate affected systems from the network while preserving evidence (Correct answer)
Run antivirus scans on all endpoints simultaneously
Pay the ransom to restore operations quickly

Correct answer: Isolate affected systems from the network while preserving evidence

Network isolation prevents further spread while preserving volatile and non-volatile evidence needed for root cause analysis and legal proceedings.

Question 8: Which log source would BEST help an analyst determine if an attacker used 'scheduled tasks' for persistence on a Windows endpoint?

Windows Security Event Log — Event ID 4624
Windows Task Scheduler Operational Log — Event ID 4698/4702 (Correct answer)
Windows Application Event Log — Event ID 1000
Windows System Event Log — Event ID 7045

Correct answer: Windows Task Scheduler Operational Log — Event ID 4698/4702

Event ID 4698 (task created) and 4702 (task updated) in the Task Scheduler Operational log specifically record scheduled task creation and modification events.

Question 9: A security analyst observes DNS queries for randomly generated domain names at high frequency. Which malware behavior does this indicate?

Domain generation algorithm (DGA) for C2 communication (Correct answer)
DNS amplification DDoS attack
DNS cache poisoning
DNS zone transfer enumeration

Correct answer: Domain generation algorithm (DGA) for C2 communication

DGA-based malware generates large numbers of pseudo-random domain names to locate its command-and-control server, making blocklists ineffective against the full range of possible domains.

Question 10: During incident response, which phase involves determining the full scope and business impact of a compromise?

Eradication
Preparation
Recovery
Identification/Scoping (Correct answer)

Correct answer: Identification/Scoping

The Identification/Scoping phase establishes what systems are affected, the attack timeline, and business impact before containment actions begin.

Question 11: Which Windows log category records events such as user logon, logoff, and privilege use?

Setup log
Application log
Security log (Correct answer)
System log

Correct answer: Security log

The Windows Security log captures authentication events, privilege escalations, and audit policy changes, making it critical for forensic investigation.

Question 12: In the context of ARP cache poisoning, which network traffic indicator would most clearly confirm an active attack is occurring?

Multiple ARP replies mapping different MAC addresses to the same IP address (Correct answer)
A high volume of ARP requests for non-existent hosts
Duplicate IP address conflict messages from DHCP
ICMP redirect messages from a router

Correct answer: Multiple ARP replies mapping different MAC addresses to the same IP address

ARP cache poisoning is characterized by unsolicited ARP replies that associate multiple (attacker-controlled) MAC addresses with a legitimate IP, redirecting traffic through the attacker.

Question 13: Which Linux command displays currently established network connections and their associated process IDs?

route -n
iptables -L
netstat -tulnp (Correct answer)
ifconfig -a

Correct answer: netstat -tulnp

The `netstat -tulnp` command lists TCP/UDP listening and established connections along with the PID and program name for each socket.

Question 14: An IDS alert fires on a packet with a TCP header where both the SYN and FIN flags are set simultaneously. What attack technique does this indicate?

SYN flood DoS
Invalid flag-combination scan (Correct answer)
TCP reset injection
TCP session hijacking

Correct answer: Invalid flag-combination scan

SYN+FIN is an invalid TCP flag combination used in stealth scanning techniques like the Xmas-variant scans to probe firewall rules or evade detection.

Question 15: A packet capture shows many TCP RST packets being sent immediately after SYN packets to various ports on a host. This pattern most likely indicates:

A TCP SYN scan (nmap -sS) (Correct answer)
An ICMP sweep
A TCP connect scan
A UDP port scan

Correct answer: A TCP SYN scan (nmap -sS)

A stealth SYN scan generates RST responses from closed ports and drops the connection on open ports, producing the observed RST burst pattern.

Question 16: A packet shows an IP header length (IHL) field of 6 (i.e., 24 bytes). What does this indicate?

The TTL value is 24
The packet is fragmented
IP options are present in the header (Correct answer)
The payload is 24 bytes long

Correct answer: IP options are present in the header

An IHL greater than 5 (the standard 20-byte header) means IP options fields are present, which can be abused for source routing or IDS evasion techniques.

Question 17: Which Windows feature uses hardware-based TPM to encrypt the entire OS volume and protect against offline attacks?

Encrypting File System (EFS)
Windows Credential Guard
BitLocker Drive Encryption (Correct answer)
Windows Defender Antivirus

Correct answer: BitLocker Drive Encryption

BitLocker leverages the TPM chip to seal the volume encryption key, ensuring that the drive cannot be decrypted if removed and placed in another machine.

Question 18: Which protocol provides secure remote shell access by replacing the insecure Telnet and uses port 22 by default?

SSL/TLS
SFTP
RDP
SSH (Correct answer)

Correct answer: SSH

SSH (Secure Shell) encrypts the command-line session, remote command execution, and file transfers over port 22, making it the standard replacement for plaintext Telnet.

Question 19: In role-based access control (RBAC), permissions are assigned to which entity?

Individual users directly
Roles, which are then assigned to users (Correct answer)
Security groups in Active Directory only
File system ACLs on each resource

Correct answer: Roles, which are then assigned to users

RBAC assigns permissions to roles (e.g., 'auditor', 'admin'), and users are granted access by being assigned to appropriate roles, simplifying permission management.

Question 20: During malware analysis, a sample is observed making calls to VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread targeting another process. What technique is indicated?

DLL hijacking via search order manipulation
Reflective DLL injection
Classic remote process injection (shellcode injection) (Correct answer)
Process hollowing of a suspended process

Correct answer: Classic remote process injection (shellcode injection)

The sequence VirtualAllocEx → WriteProcessMemory → CreateRemoteThread is the canonical Windows API pattern for injecting shellcode into a remote process.

Question 21: When conducting network forensics, an analyst captures traffic and notices TLS-encrypted sessions to an unusual port (4444). What is the MOST appropriate next step?

Decrypt the traffic using the server's private key
Assume the traffic is benign since it uses encryption
Analyze JA3 fingerprints and certificate details to identify the TLS client/server (Correct answer)
Immediately block the destination IP at the firewall

Correct answer: Analyze JA3 fingerprints and certificate details to identify the TLS client/server

JA3 fingerprinting extracts TLS handshake parameters to create a hash that can identify specific malware families or C2 frameworks even without decrypting the traffic.

Question 22: An analyst uses 'tcpdump -r capture.pcap -n tcp and port 443' to filter a pcap. What does the '-n' flag do?

Sets the snapshot length for captured packets
Enables VLAN tag display
Disables DNS resolution so IP addresses are displayed numerically (Correct answer)
Limits capture to n packets

Correct answer: Disables DNS resolution so IP addresses are displayed numerically

The '-n' flag in tcpdump prevents hostname resolution, making output faster and avoiding DNS lookups that could alter timestamps or obscure true IP addresses.

Question 23: What is the primary purpose of the 'pass' rule action in Snort?

To block and reset the connection
To forward the packet to a secondary sensor
To ignore packets that match the rule and stop further processing (Correct answer)
To log the packet without generating an alert

Correct answer: To ignore packets that match the rule and stop further processing

A Snort 'pass' rule causes matching packets to be silently allowed and stops further rule evaluation for those packets, often used to whitelist trusted traffic.

Question 24: Which field in an IP header is used to detect and prevent packet fragmentation reassembly attacks in an IDS?

Identification field and fragment offset (Correct answer)
Protocol field
Time to Live (TTL)
Differentiated Services Code Point (DSCP)

Correct answer: Identification field and fragment offset

The Identification field links fragments and the Fragment Offset field orders them; IDS rules that track these fields detect overlapping or malformed fragment reassembly exploits.

Question 25: In a packet header, a TTL value of 127 arriving at a destination suggests the packet most likely originated from:

A Windows system (default TTL 128, decremented once in transit) (Correct answer)
A Cisco router (default TTL 255)
A network printer (default TTL 32)
A Linux/Unix system (default TTL 64)

Correct answer: A Windows system (default TTL 128, decremented once in transit)

Windows systems default to TTL 128; a received value of 127 implies exactly one hop, consistent with a Windows host one router away from the destination.

Question 26: A threat hunter suspects lateral movement via SMB. Which tool would BEST help identify unusual SMB connections between internal hosts?

Nmap with -sV version detection flags
Zeek (formerly Bro) network security monitor analyzing smb_files.log and conn.log (Correct answer)
Wireshark packet captures on the external perimeter firewall
Vulnerability scanner targeting SMB shares

Correct answer: Zeek (formerly Bro) network security monitor analyzing smb_files.log and conn.log

Zeek parses SMB protocol details into structured logs (smb_files.log, smb_mapping.log) that enable efficient hunting for unusual file transfers, share access, and lateral movement patterns.

Question 27: Which of the following best describes the purpose of 'threshold' in a Snort rule?

To specify how deeply Snort inspects packet payload
To set the minimum packet size for triggering the rule
To limit alert frequency so a single event does not flood logs (Correct answer)
To define the maximum TTL value to match

Correct answer: To limit alert frequency so a single event does not flood logs

The threshold keyword controls how often Snort generates an alert for a rule, using types like 'limit', 'threshold', or 'both' to suppress alert storms.

Question 28: What does the Snort rule option 'content:"GET"; depth:4;' do?

Restricts the match to layer-4 headers only
Matches 'GET' starting at byte offset 4
Matches 'GET' only within the first 4 bytes of the payload (Correct answer)
Matches 'GET' exactly 4 times

Correct answer: Matches 'GET' only within the first 4 bytes of the payload

The 'depth' keyword limits the content search to the specified number of bytes from the start (or from the previous match anchor), so 'depth:4' checks only the first 4 bytes.

Question 29: Which Snort rule keyword instructs Snort to match traffic flowing FROM the server BACK to the client, regardless of port numbers defined in the rule header?

flow:from_server,established (Correct answer)
flags:A+
threshold:type limit
session:printable

Correct answer: flow:from_server,established

The 'flow:from_server,established' keyword matches packets in established sessions traveling from server to client, enabling bidirectional traffic analysis.

Question 30: Which protocol does ICMP type 3, code 3 indicate, and why is it relevant to intrusion analysts?

Redirect message; used in MITM routing attacks
Echo request; baseline for ICMP sweep detection
Time exceeded; used in traceroute and TTL expiry analysis
Destination unreachable – Port unreachable; can indicate port scanning or firewall rules blocking traffic (Correct answer)

Correct answer: Destination unreachable – Port unreachable; can indicate port scanning or firewall rules blocking traffic

ICMP type 3 code 3 (Port Unreachable) is returned when a UDP packet reaches a host but no service is listening, making it useful for detecting UDP port scans.

Question 31: Which wireless attack captures the 4-way WPA2 handshake to perform offline password cracking?

Beacon flooding
Evil twin attack
KRACK attack
Deauthentication + handshake capture (Correct answer)

Correct answer: Deauthentication + handshake capture

By sending forged deauthentication frames to force a client to reconnect, an attacker captures the WPA2 4-way handshake and then brute-forces the passphrase offline.

Question 32: Which of the following BEST describes a 'pass-the-hash' attack?

Using a captured NTLM hash directly to authenticate without knowing the plaintext password (Correct answer)
Exploiting weak password hashing algorithms to forge authentication tokens
Intercepting Kerberos tickets transmitted over the network
Cracking a captured NTLM hash using a rainbow table offline

Correct answer: Using a captured NTLM hash directly to authenticate without knowing the plaintext password

Pass-the-hash uses the NTLM hash of a password as the credential for network authentication, bypassing the need to crack it to plaintext.

GIAC Certification

GIAC (Global Information Assurance Certification) certifications validate cybersecurity skills across domains including intrusion analysis, digital forensics, penetration testing, cloud security, and malware analysis. Exams are proctored and open-book, testing both theoretical knowledge and practical application.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds