GCIA Fundamentals of Traffic Analysis Practice Test

These questions are part of the practice quiz. Start practicing

• Where is the IHL value stored in the IP header, and how is it used to determine the header length?
• What is the RFC-specified default fragment expiry time?
• Which IPv4 prefix is a private address range?
• Fragment sizes, except possibly the last, are constrained by the MTU.
• What is the IP protocol number for ICMP?
• How many traffic classes does IPv6's Traffic Class field support for QoS?
• Which statement best describes Stateless Address Auto-Configuration as it relates to deriving the interface identifier?
• Which prefix is used for 6over4 addressing?
• Which mechanism uses ICMPv6 to report the maximum packet size that can be forwarded without fragmentation?
• What is the hexadecimal representation of the decimal value 1500?
• Which statement best describes IP reliability?
• Which prefix is used for IPv6 global unicast addresses?
• What RFC defines the IP header checksum calculation?
• What is the Ethernet protocol number as listed?
• IP options must fall on which boundary?
• SEND is described as which of the following?
• Which IPv6 prefix is used for 6to4 transition addresses?
• Which of the following is the IPv6 unicast loopback address?
• What do routers do regarding the IP checksum when forwarding packets?
• The Fragment Offset field is how many bits wide?
• IP header corruption occurs when which elements are swapped exactly in the IP header?
• Which statement about fragmentation is true?
• Which ICMPv6 type is Router Advertisement?
• Which layer handles inter-network routing and logical addressing in the TCP/IP model?
• What is the Ethernet MTU size?
• Under IPv4 fragmentation, when does fragmentation occur?
• Which protocol is the IPv6 version of ARP and what messages does it use?
• ECN bit values: what does the value 11 indicate?
• The Protocol Number Offset is located in which byte of the IP header?
• Which RFC defines IPv6 Extension Header Options?
• Which pair of fragmentation evasion techniques is commonly used against IDS/IPS?
• In the described unconventional IP value handling, which source IPs entering state is listed?
• During fragmentation, where is the embedded protocol header stored?
• What operation is performed on each 16-bit word during IP checksum calculation?
• Which RFC governs the Transmission Control Protocol?
• A nibble refers to how many bits?
• What is the decimal value of hexadecimal 0x00B9?
• Which statement correctly describes how to derive the header length from the IHL value?
• What is a Teredo Bubble Packet used for?
• What is the maximum value of the IP header length (IHL) value when multiplied by 4 to obtain bytes?
• Which RFC defines the Internet Protocol (IPv4)?
• Which range defines ICMPv6 error messages?
• In Stateless Address Auto-Configuration, what are the first 10 bits of the generated link-local address?
• Which transport does 6to4 utilize to carry IPv6 packets?
• What is the protocol number associated with Wireless Protocol?
• Which ICMPv6 type is Router Solicitation?
• During an NDP Man-in-the-Middle attack, spoofing which message causes traffic to be redirected to the attacker?
• What is the maximum number of IP addresses that can be stored using the Record Route option?
• What is the broadcast ARP address?
• To obtain the actual offset from the Fragment Offset field value, you multiply by what?
• What is the protocol number for Generic Routing Encapsulation (GRE)?
• Which statement about Teredo is accurate?
• Embedded checksums apply to which protocols and where calculated?
• Which device validates the IP checksum and recalculates before forwarding?
• Which behavior is associated with NDP DoS?
• What is the bit length and format of the ARP broadcast destination?
• Is ARP a routable protocol?
• In an ARP request, which statement about the target MAC address is true?
• Which IPv6 prefix is reserved for private (local) addressing?
• Which ICMPv6 message is sent by a host to determine first-hop devices upon joining a network?
• What does a UDP Length field value of 0 indicate?
• Embedded checksums cover TCP, UDP, and ICMP and are calculated where?
• What is the Bluetooth Protocol Number?
• What is the fixed header length of an Ethernet frame?
• Next Header value for the IPv6 fragment header?
• Which action is described as NDP ARP poisoning?
• How is the IP header checksum computed?
• Which IPv4 issue relates to fragmentation with small MTU?
• Which IPv4 issue concerns routing tables becoming unwieldy?
• UDP checksum in IPv4: is it mandatory or optional?
• Which statement accurately describes how IPv6 handles checksums?
• RA is issued in response to which event?
• What is the IP protocol number for UDP?
• Teredo is used to transition IPv4 to IPv6 by tunneling IPv6 over which transport protocol?
• What is the IP protocol number for TCP?
• When Teredo tunnels IPv6, the payload is encapsulated inside which combination?
• What is a common use case for Teredo?
• What is the maximum value for the IP ID field?
• Which attack uses overlapping IP fragment offsets to crash a target system?
• The first IP option value begins at which byte offset within the IP header?
• What best describes a fragment train in IPv4 fragmentation?
• What is the RFC number for Neighbor Discovery Protocol (NDP)?
• Which ICMPv6 type is Neighbor Advertisement?
• Which IPv4 address block is reserved for documentation and examples?
• What is 6to4?
• What is the size of the IP ID field in IPv4?
• Which IPv6 header field replaces the IPv4 ToS concept for traffic prioritization?
• Which prefix identifies IPv6 multicast addresses?
• Which statement describes IPv6 Path Discovery?
• Which IPv4 issue is described as overhead related to checksum calculations?
• Using 6to4, the IPv6 address derived from 10.10.10.10 is which?
• IP options in fragments are replicated only if the high-order bit is set to 1.
• Which value is the Solaris default TTL?
• Is CRC considered data? Do sniffers capture the CRC value?
• In IP fragmentation, the Fragment Offset field value is measured in 8-byte units.
• What is the primary use of the Differentiated Services Byte in IP headers?
• If you see IPv6-like payloads inside UDP packets destined to port 3544, which protocol is likely in use?
• What is the Linux default TTL value?
• What is the purpose of Duplicate Address Detection (DAD) in IPv6?
• Which statement is true about Ethernet frame sizing?
• Which field in Ethernet frames is used to detect frame corruption?
• Which messages are used by IPv6 Neighbor Discovery Protocol (NDP)?
• IPv4 header length can be extended up to how many bytes when IP options are present?
• The Teredo Bubble Packet primarily ensures what?
• Which method helps protect against ARP spoofing as described in the material?
• Which IP header field indicates how far a datagram has been fragmented?
• What is a CAM flood and what effect does it have on a switch?
• Which RFC defines the key words MUST, SHOULD, and MAY to indicate requirement levels in standards?
• Which ICMPv6 type is Neighbor Solicitation?
• Which statement is true about IP source routing options?
• Which of the following are legitimate uses for Gratuitous ARP?
• Which statement about data length calculation is true?
• Which IP address is the IPv4 loopback address?
• ARP operates within which scope of the network?
• Which RFC governs the User Datagram Protocol?
• Which RFC defines the Internet Control Message Protocol (ICMP)?
• What is the size of the Ethernet frame header?
• Cyclic Redundancy Check (CRC) in Ethernet frames is how many bytes?
• What is the maximum Ethernet frame size in bytes?
• Convert hexadecimal 0x05DC to decimal.
• What is required for Loose Source Routing?
• Which ICMPv6 type corresponds to Echo Request?
• Which range defines ICMPv6 informational messages?
• What phenomenon is described by the Ping of Death?
• Which IPv6 address is designated for documentation and examples?
• If the Ethernet frame shows Ethertype 0x86dd, which protocol is being carried?
• What is the purpose of the IP Record Route option?
• Record Route option stores what type of data in the IP header?
• Which protocol uses stateful address auto-configuration to assign IPv6 addresses?
• Which RFC documents ARP?
• Which ICMP message is elicited when a zero-offset fragment is sent but the full train is not reassembled in time?
• Which padding values are used to pad IP options to a 4-byte boundary?
• What is the Ethernet minimum frame size?
• The IPv4 header length is typically how many bytes?
• IP option sizes are represented in how many bytes?
• Which statement describes SEND's security feature?
• Which of the following lists the three length/value fields in the IP header used to describe the datagram?
• Which value is shared across all fragments of the same original IPv4 packet?
• What happens to overlapping IPv6 fragments?
• Ethernet 'Type' field value that identifies IPv6?
• Fragment offset value represents what in IPv4 fragmentation?
• What is the maximum size of an IP packet?
• Which NMAP flag enumerates valid protocols on a target?
• Which UDP port is associated with Teredo?
• What is the length of a Layer 2 MAC address in bytes?
• Which TCP/IP layer provides end-to-end data transport and reliability?
• Which prefix is used for Teredo IPv6 addresses?
• Which fragmentation evasion techniques are commonly used against IDS/IPS?
• Which IP header field specifies the length of the entire datagram in bytes?
• DHCPv4 uses which UDP ports?
• Fragment offset values are always multiples of which number?
• What is the IPv6 prefix used for 6over4 addressing?
• Which IPv6 address block is reserved for private use and is not globally routable?
• Which IPv6 prefix is used to embed IPv4 addresses within IPv6 addresses (IPv6 to IPv4 addresses)?
• Which statement about the Differentiated Services Byte is true?
• In Path MTU Discovery, which type of message is used to convey the MTU value along the path to the sender?
• Does IPv6 define a separate header checksum?
• What does the ECN value 01/10 signify?
• The lower order 64 bits of the SLAAC link-local address are derived from which source using EUI-64 formatting?
• What is the standard format of an IP option?
• Data Length (payload size in an IP packet) is calculated as which expression?
• Which prefix is used for IPv4-mapped IPv6 addresses?
• In a MAC address, what designation is given to the first 3 bytes and what does it designate?
• What type of payload is carried inside a Teredo tunnel's UDP encapsulation?
• A network analyst logs UDP port 3544; which technology might be involved?
• What is the fixed IPv6 header length?
• Which transport protocol does Teredo predominantly use to traverse NATs?
• Which IPv6 prefix denotes a link-local address?
• Which of the following is the correct top-to-bottom order of the TCP/IP model layers?
• What is the purpose of a Teredo Bubble Packet?
• What does CAM stand for in networking hardware?
• Which item is not used in the data length calculation for an IP datagram?
• Which statement about the IPv6 Payload Length field is true?
• Which encapsulation best describes how Teredo carries IPv6 traffic over an IPv4 network?
• How is the IPv6 next hop determined when the destination is not in the local link?
• What is Gratuitous ARP?
• What is the RFC number for ARP?
• In NDP Man-in-the-Middle (MitM) attacks, which action is used to intercept traffic?
• The maximum Ethernet frame size of 1518 bytes is composed of which components?
• Which IPv4 issue relates to the exhaustion of 32-bit addresses?
• Which IPv6 header field is calculated as the payload size and is the evolution of the Datagram Length field?
• DHCPv6 uses which UDP ports?
• Fragment offset is counted in what unit?
• What is the default TTL value associated with Microsoft systems?
• In IPv6, which concept serves as the closest equivalent to broadcast, given that IPv6 does not use broadcast?
• What happens if the Don't Fragment (DF) flag is set?
• Which standards family is represented by the 802.X naming in networking?
• What is the purpose of sharing the IP ID across all fragments of a single original packet?
• Which prefix denotes IPv4 multicast addresses?
• DHCPv6 provides which type of address auto-configuration?
• According to RFC 1121, what should be done with a datagram that has an invalid IP version?
• What is the size of the IP header checksum field?
• When IPv4 addresses are exhausted, what did IANA announce in early 2011?
• Which action does a router take regarding the IP header when forwarding a packet?
• What is the hexadecimal representation of decimal 1480?
• What happens if the IP header checksum is invalid?
• ICMPv6 Type 129 corresponds to which message?
• To meet the 64-byte minimum Ethernet frame size, what is the required payload size given a 14-byte header and a 4-byte CRC?
• Which statement best describes Teredo?
• In IPv6, what is the field that replaces the IPv4 TTL concept called?
• What does the MF (More Fragments) bit indicate?
• According to the described unusual IP values, which describes source IPs entering your network?
• In the described unconventional IP value handling, which destination IP entering state is listed?
• Which RFC defines NDP Trust Models and Threats?
• What is required for Strict Source Routing?
• In a fragment train, which statement best describes fragment sizes?
• Which action constitutes NDP Gratuitous ARP?
• What is the minimum supported MTU for IPv6?
• Which of the following statements about Teredo traffic capture is true?
• Which statement best describes GRE?