10 exam-style questions with answers and explanations, straight from our 1,054-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The GCIA exam has 106 questions and runs 4 hours.
These 10 free GCIA questions are organized by exam domain, so you can see how each part of the GIAC Certified Intrusion Analyst blueprint is tested. Reveal the answer and explanation under each question.
Using the same IP header shown below, what can be determined about this packet's role in a fragmented datagram? 45 00 05 dc 1c 46 20 b9 40 06 00 00 c0 a8 00 68 c0 a8 00 01
Correct answer: A - It is a middle fragment, positioned between other fragments of the datagram
A fragment carries a fragment offset field value of 185. At which byte position in the original datagram does this fragment's payload begin?
Correct answer: C - 1480
Consider the following rule: alert tcp any any -> $HOME_NET 80 (msg:"Test"; content:"admin"; offset:5; depth:10; sid:1000001;) Which packet causes this rule to generate an alert?
Correct answer: B - A packet to port 80 with "admin" beginning at payload byte 7 of the request
In a Snort or Suricata rule, what is the fundamental difference between the 'depth' modifier and the 'within' modifier?
Correct answer: C - depth is measured from the payload start, while within is measured from the previous match
An Ethernet frame totals 504 bytes: a 14-byte Ethernet header, a 20-byte IP header, a 20-byte TCP header, and 450 bytes of application data. Does a rule containing 'dsize:>500;' fire on this packet?
Correct answer: D - No, since dsize counts only the 450 bytes of application data, which is below the threshold
An analyst captures a packet whose IP header begins with the byte 0x48. What is the total length of this IP header?
Correct answer: B - 32 bytes, because the low nibble is multiplied by 4
Given the IP header below, what is the value of the TTL field? 45 00 05 dc 1c 46 20 b9 40 06 00 00 c0 a8 00 68 c0 a8 00 01
Correct answer: C - 0x40, which is 64
What is the decimal value of the TCP flags byte in a SYN-ACK packet?
Correct answer: D - 18
A Linux host receives a TCP packet with only the FIN flag set, directed at a port on which no service is listening. How does the host respond?
Correct answer: A - It sends a RST, because the port is closed
An analyst writes the tcpdump filter 'tcp[13] = 2' intending to capture all packets that have the SYN flag set. Why does this filter fail to meet that goal?
Correct answer: B - An exact byte match excludes SYN-ACK and any other flag combination
The GCIA exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,044 more GCIA questions with explanations.
Continue in the free practice test →
View plans