Practice for the GIAC Security Essentials (GSEC) exam with 14 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which field in an ICMP header is used to indicate the function or purpose of the communication?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the GSEC practice test →
What you will practice
- Which field in an ICMP header is used to indicate the function or purpose of the communication?
- When examining packets collected from an unknown network communication, you notice that the Protocol Number f…
- What type of device is the Zigbee wireless technology most commonly associated with?
- What is the response received by a client when communicating with a service on an open UDP port?
- You have ANDed the local netmask with your destination's IP address. What can you determine from this operati…
- How can you calculate the size of the payload of a UDP datagram that is captured during a network sniffing ev…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which field in an ICMP header is used to indicate the function or purpose of the communication?
Answer: C. C) Type
The Type field defines the primary function or purpose of an ICMP message. Watch out for Protocol Number or EtherType, because those belong to IP and Ethernet headers respectively, not ICMP.
Q2. When examining packets collected from an unknown network communication, you notice that the Protocol Number field in several IP headers is set to a value of 0x11. What does this indicate?
Answer: D. D) The payload is UDP.
A Protocol Number of 17, which is 0x11 in hexadecimal, indicates that the IP payload is UDP. Remember that TCP is protocol 6, so a hex value of 0x06 would be required for the payload to be TCP.
Q3. What type of device is the Zigbee wireless technology most commonly associated with?
Answer: B. B) Home automation
Zigbee is a low-power, low-bandwidth wireless standard designed primarily for home automation and sensor networks. It is not built for high-speed internet connectivity, which relies on technologies like LTE or Wi-Fi.
Q4. What is the response received by a client when communicating with a service on an open UDP port?
Answer: C. C) Nothing
Because UDP is connectionless, sending data to an open UDP port typically yields no protocol-level response. Remember that ICMP Type 3 Code 3 is only returned when attempting to reach a closed UDP port.
Q5. You have ANDed the local netmask with your destination's IP address. What can you determine from this operation?
Answer: C. C) Whether the destination is in a remote subnet
ANDing the subnet mask with a destination IP address calculates the destination network ID. By comparing this to your local network ID, you immediately know if the target is local or on a remote subnet.
Q6. How can you calculate the size of the payload of a UDP datagram that is captured during a network sniffing event?
Answer: D. D) Subtract 64 bits from the UDP header length field value.
Subtracting 64 bits from the UDP length field calculates the payload size because the 8-byte header is always 64 bits. Remember that the UDP length field includes both the header and the payload, not just the payload itself.
Q7. How does ICMP communication operate when it does not have address or port support in its header?
Answer: B. B) It rides as the payload of an IP packet.
ICMP relies on riding as the payload of an IP packet, borrowing the necessary addressing from the IP header. A practical cue is that ICMP operates at Layer 3, meaning it completely avoids using Layer 4 ports or sessions.
Q8. How can an administrator use the ping command to determine where along a communication path an error exists?
Answer: A. A) Ping in order: loopback, local IP address, default gateway address, an internal LAN address, proxy/gateway internal address, proxy/gateway external address, then several Internet addresses.
Pinging destinations from local to remote allows you to pinpoint exactly where the communication path breaks. If you started from the outside in, you would struggle to isolate whether the failure is local or happening further down the route.
Q9. You are selecting the hardware to comprise a virtual machine server host. Which of the following is most critical to ensure high levels of performance when serving large numbers of clients and using a SAN?
Answer: B. B) Network interface capacity
Network interface capacity is critical because a SAN relies on the network for storage traffic, which easily creates bottlenecks. While CPU cores matter, the combined load of client traffic and storage read and writes makes the network card the most likely choke point.
Q10. What is the most important feature or benefit provided by CIDR?
Answer: A. A) It reduced the size of routing tables.
CIDR was primarily adopted to reduce the size of core Internet routing tables by combining multiple subnets into a single route. Remember that Variable Length Subnet Masking actually initiated the move away from strict class-based subnetting.
Q11. How does a sending system know that a window set of packets was not properly received and that a re-transmission of the window is required?
Answer: C. C) There is no acknowledgement within a timeout period
A lack of an acknowledgement within a specific timeout period tells the sender to re-transmit the window. A failed checksum silently drops the packet, but it is the resulting timeout on the sender side that actually forces the retransmission.
Q12. Which of the following statements is true regarding security management for an operating system hosted in a virtual machine?
Answer: A. A) All OSs need security management, no matter how they are hosted.
All operating systems need security management, whether they are physical or virtual, because virtualization does not provide inherent protection. Host and guest systems require independent patching and security controls, as host protections do not automatically secure the guests.
Q13. What network type is confined to a limited geographical area?
Answer: C. C) LAN
A Local Area Network is confined to a limited geographical area, such as a single building or campus. For the exam, remember that a Wide Area Network spans large distances, while a Virtual Private Network secures connections across existing networks.
Q14. What is the top reason for organizations to adopt virtual machines instead of using traditional physical systems?
Answer: C. C) Cost reduction
Consolidating multiple virtual machines onto fewer physical hosts directly lowers hardware, power, and cooling costs. While deployment might seem easier, managing hypervisors and avoiding a single point of failure actually adds complexity to the infrastructure.
More GSEC drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.