GIAC GCIA QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Section 1: TCP/IP Fundamentals & Packet Analysis
1. What is the primary purpose of the TCP three-way handshake?
A) Encrypt data
B) Establish a reliable connection
C) Assign IP addresses
D) Route packets
Answer: B
Rationale: The SYN, SYN-ACK, ACK sequence synchronizes sequence numbers and confirms both hosts are
ready to communicate reliably.
2. Which TCP flag combination indicates a scan using a "Christmas tree" packet?
A) SYN only
B) FIN, PSH, URG
,C) ACK, RST
D) SYN, ACK
Answer: B
Rationale: The Christmas tree scan sets FIN, PSH, and URG flags, lighting up the packet "like a tree."
3. In a TCP header, what does the window size field indicate?
A) Maximum segment size
B) Available buffer space
C) Sequence number
D) Checksum
Answer: B
Rationale: Window size tells the sender how much data the receiver can accept without acknowledgment.
4. What is the default TTL for a Windows 10 system?
A) 64
B) 128
, C) 255
D) 32
Answer: B
Rationale: Windows uses 128; Linux/Unix typically use 64; network devices often 255.
5. Which protocol uses UDP port 53?
A) HTTP
B) DNS
C) SMTP
D) SSH
Answer: B
Rationale: DNS queries primarily use UDP 53; zone transfers use TCP 53.
6. What does an ARP request with target IP 0.0.0.0 indicate?
A) Gratuitous ARP
B) ARP probe
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Section 1: TCP/IP Fundamentals & Packet Analysis
1. What is the primary purpose of the TCP three-way handshake?
A) Encrypt data
B) Establish a reliable connection
C) Assign IP addresses
D) Route packets
Answer: B
Rationale: The SYN, SYN-ACK, ACK sequence synchronizes sequence numbers and confirms both hosts are
ready to communicate reliably.
2. Which TCP flag combination indicates a scan using a "Christmas tree" packet?
A) SYN only
B) FIN, PSH, URG
,C) ACK, RST
D) SYN, ACK
Answer: B
Rationale: The Christmas tree scan sets FIN, PSH, and URG flags, lighting up the packet "like a tree."
3. In a TCP header, what does the window size field indicate?
A) Maximum segment size
B) Available buffer space
C) Sequence number
D) Checksum
Answer: B
Rationale: Window size tells the sender how much data the receiver can accept without acknowledgment.
4. What is the default TTL for a Windows 10 system?
A) 64
B) 128
, C) 255
D) 32
Answer: B
Rationale: Windows uses 128; Linux/Unix typically use 64; network devices often 255.
5. Which protocol uses UDP port 53?
A) HTTP
B) DNS
C) SMTP
D) SSH
Answer: B
Rationale: DNS queries primarily use UDP 53; zone transfers use TCP 53.
6. What does an ARP request with target IP 0.0.0.0 indicate?
A) Gratuitous ARP
B) ARP probe
