GIAC Certified Intrusion Analyst Free Sample Questions

An analyst is reviewing logs from a compromised web server to trace lateral movement. They have access to Zeek's conn.log and dce_rpc.log. During the incident window, they observe a successful web shell upload followed by an outbound connection from the web server (192.168.10.5) to a domain controller (192.168.10.10) on TCP port 445. Shortly after, the domain controller makes SMB connections to several other critical servers. Which of the following Zeek log entries would provide the strongest evidence of the specific lateral movement technique used? (Select TWO)

A financial services company has deployed a new NIDS solution at its internet edge. The network architecture uses asymmetric routing for outbound traffic, meaning that traffic leaving the organization may exit through one of two different ISP links, but all return traffic for a given session is guaranteed to arrive via the same link it departed from. The NIDS is placed inline on the primary ISP link but only has a TAP on the secondary link. Analysts are reporting a high volume of alerts for TCP sessions that appear to be incomplete or have anomalous state transitions, but upon investigation, the traffic is benign.

The security team is also concerned about the NIDS's ability to reassemble fragmented packets and maintain state for application-layer protocols like HTTP/2, which rely on a single, long-lived TCP connection. The primary goal is to achieve reliable threat detection without impacting the performance of the high-speed links. Which of the following is the most effective strategy to address the false positives and ensure reliable detection?

An analyst is examining an IPv6 packet capture and finds a packet with a chain of extension headers. The goal is to determine if this packet is being used to bypass a security device that only inspects a limited number of headers. Which extension header, if placed before the Destination Options header, would be the most likely to contain the actual final destination address that a compromised host would process?

True or False: An anomaly-based Intrusion Detection System (IDS) can potentially detect novel, never-before-seen attacks, but it is also more prone to false positives than a signature-based IDS.