GIAC GCIA Practice Test

GCIA practice test: what's covered

• Packet Analysis
• Snort/Zeek
• Traffic Anomaly Detection

Free GCIA sample questions

1. During a routine network monitoring shift, you notice anomalous traffic on port 443. The traffic exhibits rapid, small burst packet sizes typical of command-and-control (C2) beaconing, but it is entirely encrypted. Which of the following two actions would provide the MOST actionable intelligence without breaking the encryption?

   • A. Perform JA3/JA3S TLS fingerprinting to identify the client application or malware family.
   • B. Analyze the Server Name Indication (SNI) field in the TLS Client Hello message to determine the requested domain.
   • C. Capture the full packet payload and attempt to brute-force the TLS session key using a dictionary attack.
   • D. Block port 443 on the perimeter firewall to prevent further data exfiltration immediately.
   Show answer

   Correct: A and B. When dealing with encrypted C2 traffic, analysts cannot view the payload. However, TLS metadata provides valuable insights. The SNI field in the Client Hello message is sent in cleartext and reveals the destination domain. JA3/JA3S fingerprinting creates a unique hash based on the TLS negotiation parameters, which can identify specific malware families or anomalous clients. Brute-forcing TLS is computationally infeasible and impractical for real-time analysis. Blocking the port without understanding the scope could disrupt legitimate services, and ICMP monitoring does not provide actionable intelligence regarding the encrypted payload's nature or intent.

2. You are analyzing a packet capture (PCAP) and observe an IPv4 header where the Total Length field is smaller than the Header Length (IHL) multiplied by 4. What does this anomaly indicate, and how might an Intrusion Detection System (IDS) handle it?

   • A. This indicates a malformed packet, often used in evasion or denial-of-service (DoS) attacks. A robust IDS should drop the packet or alert on protocol anomaly.
   • B. This indicates fragmentation where the payload is sent in subsequent packets. The IDS will reassemble it normally.
   • C. This is a standard feature of IPv6 transition mechanisms (e.g., Teredo) and is safely ignored by most modern IDS platforms.
   • D. This means the packet is an ICMP echo request with zero payload, which is common in network discovery scans.
   Show answer

   Correct: A. In an IPv4 header, the Internet Header Length (IHL) specifies the length of the header in 32-bit words, and the Total Length field specifies the length of the entire packet (header + data). It is mathematically impossible for the Total Length to be less than the calculated header length. This represents a severely malformed packet, often crafted intentionally by attackers to crash networking equipment, evade detection, or exploit parsing vulnerabilities in security appliances. A properly configured IDS/IPS should recognize this protocol anomaly and drop or alert on the packet immediately.

3. You are tasked with writing a Snort rule to detect a specific type of malicious activity characterized by pattern sequence ID 3. You need to ensure the rule is performant and does not cause false positives on high-throughput links. Which rule option is MOST appropriate in this scenario?

   • A. Use the 'flow:established,to_server' option combined with a 'fast_pattern' match on the most unique string 3.
   • B. Utilize a regular expression with 'pcre' without any preceding 'content' matches to ensure deep inspection 3.
   • C. Enable 'byte_test' to evaluate the entire payload starting from the end of the payload backwards for flow 3.
   • D. Use 'flow:stateless' and match on the HTTP response body without checking the HTTP status code 3.
   Show answer

   Correct: A. When writing Snort rules for high-throughput environments (pattern 3), performance is critical. The 'fast_pattern' modifier instructs the Snort multi-pattern matcher (MPM) to use the specified string for its initial fast evaluation, significantly reducing the number of packets that undergo full rule evaluation. Combining this with 'flow:established,to_server' ensures that the rule only evaluates complete, bidirectional TCP connections heading towards the server, avoiding state-exhaustion and minimizing false positives. Using 'pcre' without a preceding 'content' match forces full regex evaluation on every packet, which degrades performance immensely.

4. You are tasked with writing a Snort rule to detect a specific type of malicious activity characterized by pattern sequence ID 4. You need to ensure the rule is performant and does not cause false positives on high-throughput links. Which rule option is MOST appropriate in this scenario?

   • A. Use the 'flow:established,to_server' option combined with a 'fast_pattern' match on the most unique string 4.
   • B. Utilize a regular expression with 'pcre' without any preceding 'content' matches to ensure deep inspection 4.
   • C. Enable 'byte_test' to evaluate the entire payload starting from the end of the payload backwards for flow 4.
   • D. Use 'flow:stateless' and match on the HTTP response body without checking the HTTP status code 4.
   Show answer

   Correct: A. When writing Snort rules for high-throughput environments (pattern 4), performance is critical. The 'fast_pattern' modifier instructs the Snort multi-pattern matcher (MPM) to use the specified string for its initial fast evaluation, significantly reducing the number of packets that undergo full rule evaluation. Combining this with 'flow:established,to_server' ensures that the rule only evaluates complete, bidirectional TCP connections heading towards the server, avoiding state-exhaustion and minimizing false positives. Using 'pcre' without a preceding 'content' match forces full regex evaluation on every packet, which degrades performance immensely.

5. You are tasked with writing a Snort rule to detect a specific type of malicious activity characterized by pattern sequence ID 5. You need to ensure the rule is performant and does not cause false positives on high-throughput links. Which rule option is MOST appropriate in this scenario?

   • A. Use the 'flow:established,to_server' option combined with a 'fast_pattern' match on the most unique string 5.
   • B. Utilize a regular expression with 'pcre' without any preceding 'content' matches to ensure deep inspection 5.
   • C. Enable 'byte_test' to evaluate the entire payload starting from the end of the payload backwards for flow 5.
   • D. Use 'flow:stateless' and match on the HTTP response body without checking the HTTP status code 5.
   Show answer

   Correct: A. When writing Snort rules for high-throughput environments (pattern 5), performance is critical. The 'fast_pattern' modifier instructs the Snort multi-pattern matcher (MPM) to use the specified string for its initial fast evaluation, significantly reducing the number of packets that undergo full rule evaluation. Combining this with 'flow:established,to_server' ensures that the rule only evaluates complete, bidirectional TCP connections heading towards the server, avoiding state-exhaustion and minimizing false positives. Using 'pcre' without a preceding 'content' match forces full regex evaluation on every packet, which degrades performance immensely.

Last updated: 2026-10-19

GCIA practice test FAQ

Related practice tests

• GIAC GCFA practice test
• GIAC GCIH practice test
• GIAC GPEN practice test