Free GIAC GNFA Exam Dumps Questions & Answers

Which approach is most effective for reverse engineering encrypted network protocols?
Response:

• A.  Inspecting payload data for plaintext strings
• B.  Conducting brute force attacks on encrypted packets
• C.  Identifying encryption algorithms and attempting decryption
• D.  Analyzing protocol headers for patterns

You are analyzing network traffic and find a series of communications using an unknown protocol. The traffic appears structured, but there is no official documentation available. What should be your first step?
Response:

• A.  Attempt brute-force decryption
• B.  Block all traffic using the protocol immediately
• C.  Search for open-source documentation
• D.  Capture and inspect the packets using Wireshark

What is the role of dynamic analysis in network protocol reverse engineering?
Response:

• A.  It analyzes live network traffic to understand protocol behavior
• B.  It inspects logs for forensic investigations
• C.  It involves executing malware to observe its behavior
• D.  It uses brute force attacks to identify weaknesses

A security analyst detects an application sending large volumes of encoded traffic to a remote server over an uncommon port. The analyst suspects data exfiltration. What should be done next?
Response:

• A.  Terminate all active network sessions
• B.  Investigate the encoding scheme used in the traffic
• C.  Immediately block the port on the firewall
• D.  Assume the traffic is normal and ignore it

What is a key limitation of NetFlow in network forensics?
Response:

• A.  It only supports TCP-based traffic
• B.  It does not capture payload data
• C.  It cannot detect encrypted traffic
• D.  It does not log timestamps