GCIA GIAC Certified Intrusion Analyst Practice Test
Gana confianza para GCIA GIAC Certified Intrusion Analyst. Practica los conceptos, comprende las respuestas y refuerza tus conocimientos pregunta a pregunta.
Probar una preguntaDescripción y detalles del examen
The GIAC Certified Intrusion Analyst (GCIA) certification is a premier, industry-recognized credential validating an individual's advanced skills in network security monitoring, intrusion detection, and incident response. Administered by the Global Information Assurance Certification (GIAC), a SANS Institute affiliate, the GCIA focuses on the deep technical analysis of network traffic to identify, respond to, and defend against sophisticated cyber threats. Earning the GCIA demonstrates mastery of core competencies including the creation and tuning of IDS/IPS signatures (particularly Snort rules), comprehensive TCP/IP protocol analysis, network forensics, and log analysis using tools like Wireshark. It signifies that the holder can move beyond alert monitoring to perform proactive threat hunting and detailed incident reconstruction. This certification is highly valued by employers in Security Operations Centers (SOCs), Computer Security Incident Response Teams (CSIRTs), and threat intelligence units, as it proves the practical ability to defend critical network infrastructure.
Preguntas de Muestra
Elige una respuesta y consulta la explicación para ver cómo funciona la práctica.
While performing traffic analysis with Wireshark on a potentially compromised workstation, you observe several TCP/IP protocol anomalies. Which observations would be considered valid indicators of suspicious network behavior warranting further investigation? (Select all that apply)
During GCIA packet-analysis review, A capture shows IPv4 protocol number 1 in the header after Ethernet decoding. What is the BEST interpretation or next analyst action?
During GCIA packet-analysis review, A span port misses short microbursts even though average utilization is low. What is the BEST interpretation or next analyst action?
You are analyzing a Snort rule designed to detect SQL injection attempts. The rule currently uses content matching with a fixed offset but is generating false positives when legitimate database queries contain similar byte sequences. You need to modify the detection logic to distinguish between actual attacks and benign traffic while maintaining sensitivity. Which combination of Snort rule options would best accomplish this objective?
During forensic analysis of network logs, you discover evidence of a multi-stage attack. Which of the following log artifacts and analytical techniques would help you reconstruct the complete attack chain and determine attacker intent? (Select all that apply)
Oportunidades profesionales y salario
Los rangos son cifras del mercado de EE. UU. salvo que se muestre un rango local.
Qué temas cubre este examen
01Concepts of TCP/IP and the Link Layer
Temas
- Concepts of TCP/IP and the Link Layer
Objetivos de aprendizaje
- Concepts of TCP/IP and the Link Layer: Demonstrate understanding of the TCP/IP communications model and link layer operations
02Fragmentation
Temas
- Fragmentation
Objetivos de aprendizaje
- Fragmentation: Demonstrate understanding of how fragmentation works, and how to identify fragmentation and fragmentation-based attacks in packet captures
03Fundamentals of Traffic Analysis and Application Protocols
Temas
- Application Protocols
Objetivos de aprendizaje
- Application Protocols: Demonstrate knowledge and skill relating to application layer protocol dissection and analysis
04IP Headers
Temas
- IP Headers
Objetivos de aprendizaje
- IP Headers: Demonstrate the ability to dissect IP packet headers and analyze them for normal and anomalous values that may point to security issues
05IPv6
Temas
- IPv6
Objetivos de aprendizaje
- IPv6: Demonstrate knowledge of IPv6 and how it differs from IPv4
06Network Traffic Forensics and Monitoring
Temas
- Network Forensics and Traffic Analysis
Objetivos de aprendizaje
- Network Forensics and Traffic Analysis: Demonstrate competence in analyzing data from multiple sources (e.g., full packet capture, netflow, log files) to identify normal and malicious behaviors
07Open-Source Intrusion Detection Systems (IDS): Snort and Zeek
Temas
- IDS Fundamentals and Network Architecture
- Intrusion Detection System Rules
Objetivos de aprendizaje
- IDS Fundamentals and Network Architecture: Demonstrate knowledge of fundamental IDS concepts, such as network architecture options and benefits/weaknesses of common IDS systems
- Intrusion Detection System Rules: Create effective IDS rules to detect varied types of malicious activity
08Packet Engineering
Temas
- Packet Engineering
Objetivos de aprendizaje
- Packet Engineering: Demonstrate knowledge relating to packet crafting and manipulation
09SiLK and Other Traffic Analysis Tools
Temas
- SiLK and Other Traffic Analysis Tools
Objetivos de aprendizaje
- SiLK and Other Traffic Analysis Tools: Demonstrate an understanding of SiLK and other tools to perform network traffic and flow analysis
10TCP
Temas
- TCP
Objetivos de aprendizaje
- TCP: Demonstrate understanding of the TCP protocol and the ability to discern between typical and anomalous behavior
11Tcpdump Filters
Temas
- Tcpdump Filters
Objetivos de aprendizaje
- Tcpdump Filters: Demonstrate ability to craft tcpdump filters that match on given criteria
12UDP and ICMP
Temas
- UDP and ICMP
Objetivos de aprendizaje
- UDP and ICMP: Demonstrate understanding of the UDP and ICMP protocols and the ability to discern between typical and anomalous behavior
13Wireshark Fundamentals
Temas
- Wireshark Fundamentals
Objetivos de aprendizaje
- Wireshark Fundamentals: Demonstrate ability to use Wireshark to analyze typical and malicious network traffic