[NEW] GIAC Certified Intrusion Analyst (GCIA)

IDS Configuration & Management (25%): Deep dive into Snort and Zeek rule creation, signature development, and strategic sensor deployment.

advanced techniques in threat intelligence reporting & Attribution (20%): Extracting Indicators of Compromise (IOCs), profiling threat actors, and analyzing attack vectors.

Incident Response & Forensics (15%): Executing proper incident handling, evidence preservation, and performing free incident investigation root cause analysis complete course.

Network Forensics & Reporting (10%): Analyzing flow data (NetFlow), reconstructing attack timelines, and generating professional stakeholder reports.

B. A stealthy TCP SYN port scan where the target is dropping packets.

C. An established FTP data transfer session.

D. A DNS zone transfer over UDP.

E. Normal ARP broadcast traffic for IP resolution.

F. An ICMP Echo Request/Reply sequence.

Correct Answer: B

Explanation:

A (Incorrect): A completed handshake requires a SYN-ACK and a final ACK, which are absent here.

C (Incorrect): FTP data transfers involve established connections and high volumes of data packets, not just initial SYNs.

D (Incorrect): The question specifies TCP packets; DNS zone transfers use TCP but would show a full connection.

E (Incorrect): ARP operates at Layer 2 and does not use TCP flags like SYN.

F (Incorrect): ICMP is a separate protocol and does not utilize the TCP state machine flags.

Question 2: You are tuning a Snort rule and want to detect a specific string "MALWARE_EXE" only within the first 50 bytes of the packet payload. Which rule option combination should you use?

B. content:"MALWARE_EXE"; offset:50;

C. content:"MALWARE_EXE"; distance:0;

D. content:"MALWARE_EXE"; within:50;

E. content:"MALWARE_EXE"; nocase;

F. content:"MALWARE_EXE"; pcre:"/^.{50}/";

Correct Answer: A

Explanation:

B (Incorrect): offset tells the engine where to start looking, which is the opposite of what is requested.

C (Incorrect): distance is used relative to a previous content match, not the start of the packet.

D (Incorrect): within is also used relative to a previous match.

E (Incorrect): nocase makes the search case-insensitive but does not restrict the search range.

F (Incorrect): While PCRE is powerful, it is less efficient for simple positional checks than the standard depth modifier.

Question 3: In a Zeek (formerly Bro) environment, which log file would be most useful for identifying the specific source and destination of a large data exfiltration event over an unencrypted protocol?

B. dhcp.log

C. conn.log

D. reporter.log

E. known_services.log

F. software.log

Correct Answer: C

Explanation:

A (Incorrect): This log records signature matches, not necessarily the byte-count flow of a connection.

B (Incorrect): This tracks IP assignments, not active traffic flow.

D (Incorrect):* This log contains internal Zeek error messages and warnings.

E (Incorrect): This simply tracks which services are running on which ports.

F (Incorrect): This tracks software versions detected on the network.

You can retake the exams as many times as you want.

This is a huge original question bank.

You get support from instructors if you have questions.

Each question has a detailed explanation.

Mobile-compatible with the Udemy app.

30-days money-back guarantee if you're not satisfied.