GIAC GCIA Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Intrusion Analyst (GCIA) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GCIA certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GCIA Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Certified Intrusion Analyst (GCIA) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Intrusion Analyst exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GCIA Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GCIA Sample Questions:
01. Egress policy permits DNS only from the internal resolver. From workstation 10.30.9.14 the sensor records a UDP query to that resolver on port 53 for corp.example.com, answered with the TC bit set, and one second later a TCP connection from the same workstation to the same resolver on port 53 carrying 4,180 bytes of response data.
Two readings are open: an ordinary retry over TCP after a truncated answer, or an attempted zone transfer against the resolver. Which observation from the capture settles it in favor of the ordinary reading?
a) The TCP session moved more than 512 bytes of response data, while an ordinary DNS answer is capped at 512 bytes whatever transport carries it.
b) The connection went to the internal resolver on port 53 rather than out to an authoritative name server on the internet, as the egress policy requires.
c) The response arrived with the authoritative answer bit clear, which shows no zone data was served.
d) The question section of the TCP query repeats the same QTYPE as the truncated UDP query, and that type is not AXFR.
02. An appliance protocol on TCP 4712 opens each request with a four-byte header followed by a two-byte big-endian length field stating how many bytes of body follow. An exploit against the appliance declares a length far larger than the body it actually sends, and the vendor's advice is to alert on any request declaring a body of more than 1,024 bytes.
Which rule option expresses that test?
a) byte_test:2,>,1024,4;
b) content:"|04 00|"; offset:4; depth:2;
c) dsize:>1024;
d) byte_jump:2,4;
03. A saved capture of a suspected ARP spoofing incident is being reviewed. tcpdump's output currently shows hostnames and service names such as .https, while the analyst needs numeric addresses and port numbers together with the source MAC address of each frame in order to spot a changing IP-to-MAC binding.
Which invocation produces that output from the file arp.pcap?
a) tcpdump -r arp.pcap -n -e
b) tcpdump -nn -e -r arp.pcap
c) tcpdump -r arp.pcap -nn -X
d) tcpdump -i eth0 -nn -e
04. A tuning change adds the following entry to the sensor configuration for a rule that is matching correctly but reporting far too often. Older Snort builds expressed the same control as a threshold: option written inside the rule.
event_filter gen_id 1, sig_id 1000455, type limit, track by_src, count 2, seconds 60
What effect does this entry have on the sensor?
a) Alerts for the rule are stopped altogether for any source address that produces more than two matches inside a 60-second window, and resume only after that source falls quiet.
b) The rule withholds its alert until a source has produced two matches inside 60 seconds, then writes one alert covering the pair.
c) The rule stops inspecting packets from a source once two of that source's packets have matched inside the window, which lowers sensor load as well as alert volume.
d) At most two alerts per 60-second window are written for each distinct source address, and the rule keeps matching every packet that satisfies it.
05. A day of outbound flows has been selected with rwfilter and written to a working file. The analyst needs the ten internal addresses that sent the most bytes, in order.
Which SiLK tool produces that ranking?
a) rwstats --fields=sip --values=bytes --top --count=10, listing the ten largest senders in order
b) rwuniq --fields=sip --values=bytes, totalling bytes for each source address
c) rwcut, printing the source address and byte count of every record
d) rwcount, binning the records into fixed intervals across the day
06. A sensor's traffic is being examined for a host issuing bare connection attempts. The capture must contain only the opening packet of each attempt: packets in which the SYN flag is set and no other TCP flag is.
Which capture filter matches that and nothing else?
a) tcp[tcpflags] & (tcp-syn|tcp-ack) != 0, using the readable flag names
b) tcp[13] & 2 != 0, testing whether the SYN bit is set
c) tcp[13] = 2, testing the flags byte for the exact value 2
d) tcp[13] & 18 = 18, testing whether SYN and ACK are both set
07. Binning 24 hours of outbound flow to one external address at five-minute resolution returns a near-constant two records and roughly 900 bytes in every bin, on TCP 443, from a single workstation. The next questions are how far the activity spreads — whether other internal hosts hold the same relationship — and whether the client software involved is the same on each.
Which two steps apply the right tool to those questions?
(Choose two.)
a) Rank the site's internal talkers for the day with rwstats --fields=sIP --values=bytes --count=20 and work down from the heaviest until the workstation appears in the table
b) Pull Zeek ssl.log for sessions to that address and compare the client fingerprints across the hosts identified
c) Re-bin the same 24 hours with rwcount --bin-size=60 to confirm the regularity holds at one-minute resolution
d) Search Zeek dns.log for the address to identify which internal hosts resolved it before connecting
e) Re-run rwfilter over the same window with the external address as the destination and pass the result to rwuniq --fields=sIP
08. Expert Information on a 20-minute capture of a large file transfer reports 1,842 entries under TCP Retransmission, 610 under TCP Dup ACK, 3 under TCP Port numbers reused, and none under Malformed Packet.
Which reading of that summary is supported by the entries themselves?
a) Duplicate ACKs alongside the retransmissions show the receiver observed the gaps too, so segments were lost on the path rather than merely absent from the file
b) A retransmission count of this size is an expected artifact of window scaling on a high-throughput transfer across a long path, and carries no information about loss on this segment
c) The absence of malformed-packet entries rules out crafted or manipulated traffic in this capture
d) The port-numbers-reused entries are evidence of a scan, since a scanner cycles rapidly through source ports
09. Twelve hours of traffic sit in 48 rotated capture files of roughly 900 MB each. You need byte totals per TCP conversation for one 20-minute window in the middle of that period. The analysis workstation has 16 GB of RAM and the files are on a local disk.
Which approach yields those totals without loading the whole data set into the graphical interface?
a) Merge all 48 files with mergecap, open the result, and apply a display filter restricting the view to the 20-minute window
b) Cut each file down to the window with editcap using its start-time and stop-time options, join the results with mergecap, then run tshark -q -z conv,tcp against the joined file
c) Run capinfos over all 48 files and add up the byte counts it reports for the files that overlap the window
d) Open the 48 files together with File > Merge and read the totals from Statistics > Conversations, sorting on the bytes column
10. Counting inbound connection attempts in a capture, you apply the display filter tcp.flags == 0x0002 and record the packet count. A colleague working from the same file applies tcp.flags.syn == 1 && tcp.flags.ack == 0 and reports a noticeably higher count.
What accounts for the difference between the two results?
a) tcp.flags == 0x0002 is capture-filter syntax, so it took effect only from the moment it was entered and covered part of the file
b) The second expression is invalid because && is not accepted in a display filter, where only the word form and compiles, so the filter bar fell back to matching every TCP packet in the file instead of reporting a parse error
c) Comparing the whole flags field for equality also requires every other bit to be clear, so initial SYNs that carry the ECN-negotiation bits fall outside it while the per-field test still matches them
d) The second expression also matches SYN/ACK packets, because constraining only the SYN bit leaves the acknowledgement bit free to be set
Answers:
|
Question: 01 Answer: d |
Question: 02 Answer: a |
Question: 03 Answer: b |
Question: 04 Answer: d |
Question: 05 Answer: a |
|
Question: 06 Answer: c |
Question: 07 Answer: b, e |
Question: 08 Answer: a |
Question: 09 Answer: b |
Question: 10 Answer: c |
Note: For any error in GIAC Certified Intrusion Analyst (GCIA) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
