200-201 Network Intrusion Analysis — 25 Questions

Question 1

During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delivery. The file contains shellcode and is extracted from network traffic, indicating it was delivered to the target. This aligns with the delivery phase.

Answer

Installation

Answer

Actions on Objectives

Answer

Weaponization

Question 2

A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?

Accepted Answer

Credential theft via phishing. The filter 'http.request' isolates HTTP request packets, and the captured POST requests to '/login.php' contain cleartext credentials ('username=admin&password=secret'). This indicates that login credentials are being transmitted in plaintext over HTTP, which is characteristic of credential theft via phishing or an unencrypted login form. The presence of a single successful-looking credential pair (admin/secret) rather than many failed attempts points to stolen credentials being submitted, not a brute-force or injection attack.

Answer

Cross-site scripting (XSS)

Answer

Brute force attack

Answer

SQL injection

Question 3

A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?

Accepted Answer

DNS responses with unusually large TXT record sizes. Option A is correct because DNS tunneling tools such as iodine and dnscat2 encode stolen data in TXT records, and unusually large TXT responses (often exceeding the typical ~255-byte string limit or padded to hundreds of bytes) are a classic signature of data being returned or acknowledged over DNS. Option E is correct because exfiltration over DNS relies on many queries to a single attacker-controlled domain, and the encoded payloads are placed in random-looking subdomains (e.g., base32/base64 labels) to smuggle data out while evading detection. Option B does not belong because ICMP echo requests are typical of ping sweeps or ICMP tunneling, not DNS-based exfiltration. Option C does not belong because consistent traffic to a C2 server on port 443 indicates HTTPS command-and-control, not DNS exfiltration. Option D does not belong because failed HTTP POST requests to a file-sharing site suggest attempted web uploads or blocked exfiltration over HTTP, not DNS.

Answer

Large number of ICMP echo requests to external hosts

Answer

Consistent traffic to a known C2 server on port 443

Answer

Multiple failed HTTP POST requests to a file-sharing site

Question 4

An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?

Accepted Answer

Return-oriented programming (ROP) gadget chains in data. Exploitation indicators include shellcode patterns (NOP sleds, ROP gadgets) and heap spray (large blocks of similar data).

Answer

Regular HTTP GET requests to a news website

Answer

DNS requests for common websites like google.com

Question 5

An analyst captures traffic and sees a TCP connection with only a SYN packet and an RST response. No SYN-ACK is observed. Which scan technique is this?

Accepted Answer

TCP SYN scan. A SYN scan sends a SYN and expects a SYN-ACK; if an RST is received, the port is closed. Incomplete handshake without SYN-ACK indicates a half-open scan.

Answer

Ping sweep

Answer

UDP scan

Answer

TCP connect scan

Question 6

An analyst identifies an alert for 'ET TROJAN Win32/DarkComet RAT Beacon'. The analyst confirms the host is infected. Which THREE phases of the Cyber Kill Chain have been completed prior to this C2 beacon? (Choose three.)

Accepted Answer

Installation. In the Cyber Kill Chain, the phases completed before C2 beaconing are: Reconnaissance, Weaponization, Delivery, Exploitation, and Installation. The question asks for two phases, but three (Installation, Exploitation, and Delivery) are actually completed prior to C2. However, based on the flag, Installation must be included. Delivery and Exploitation are also correct because without delivery the malware cannot be installed, and exploitation enables installation.

Answer

Weaponisation

Answer

Reconnaissance

Question 7

A SOC analyst is investigating a suspected data exfiltration. Which THREE indicators in network traffic are most consistent with exfiltration? (Choose three.)

Accepted Answer

Large outbound data transfers to an external IP at unusual hours. Large outbound data transfers to an external IP at unusual hours (A) are a classic indicator of data exfiltration because attackers often move stolen data during off-peak times to evade detection. This behavior deviates from normal business traffic patterns and can be flagged by network monitoring tools as anomalous. The volume and timing together suggest intentional data theft rather than routine operations.

Answer

Consistent HTTPS traffic to a CDN

Answer

Increased inbound web traffic

Question 8

An analyst reviews a PCAP and sees HTTP requests containing script tags and event handlers such as 'onload' and 'onerror'. Additionally, the URI contains 'alert(1)'. Which TWO types of attacks are indicated? (Select 2)

Accepted Answer

Reflected XSS. The presence of script tags, event handlers like 'onload' and 'onerror', and the URI containing 'alert(1)' indicates that the attacker is injecting client-side script into the HTTP response. Since the payload is reflected in the URI (likely in a query parameter or path) and executed immediately in the browser without being stored on the server, this is Reflected XSS (option B). The same payload can also be executed via client-side JavaScript that manipulates the DOM using untrusted data from the URI, which is characteristic of DOM-based XSS (option C).

Answer

Command injection

Answer

Stored XSS

Answer

SQL injection

Question 9

In Wireshark, which filter can be used to quickly find all HTTP requests that contain a specific keyword in the URL?

Accepted Answer

http.request.uri contains "keyword". The http.request filter combined with a contains operator can isolate HTTP requests with specific patterns.

Answer

dns.qry.name contains "keyword"

Answer

tcp.port == 80

Answer

ip.src == 10.0.0.1

Question 10

Which MITRE ATT&CK tactic corresponds to the Cyber Kill Chain phase 'Actions on Objectives'?

Accepted Answer

Impact. In the Cyber Kill Chain, 'Actions on Objectives' is the final phase where the attacker achieves their goal — data theft, destruction, encryption, or service disruption. In MITRE ATT&CK, this maps most directly to the Impact tactic, which covers techniques like Data Encrypted for Impact (T1486, ransomware), Data Destruction (T1485), and Defacement (T1491). Impact represents the adversary's endgame against confidentiality, integrity, or availability.

Answer

Privilege Escalation

Answer

Command and Control

Answer

Exfiltration

Question 11

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

Accepted Answer

SMB brute force. Option B (SMB brute force) is correct because the PCAP shows multiple failed SMB authentication attempts from a single host against different targets, which is the classic signature of repeatedly guessing credentials over SMB (TCP 445) until one succeeds. Option E (Pass-the-hash) is correct because after the failed attempts a successful authentication occurs, and pass-the-hash lets an attacker authenticate to SMB using a captured NTLM hash instead of the plaintext password, which can appear as a valid logon following earlier failed attempts. The other options do not fit: SQL injection (A) targets database queries over HTTP/SQL protocols, not SMB authentication; ARP spoofing (C) is a Layer 2 man-in-the-middle technique that would show forged ARP replies, not SMB logon failures; and DNS tunnelling (D) exfiltrates data via DNS queries, which is unrelated to SMB authentication sequences.

Answer

SQL injection

Answer

ARP spoofing

Answer

DNS tunnelling

Question 12

A PCAP contains the following patterns: (1) A TCP connection with a complete handshake to an external IP on port 443, (2) periodic data transfers every 60 seconds of approximately 1 KB, (3) the domain name in the TLS SNI field is generated by a DGA. Which THREE indicators are present?

Accepted Answer

Beaconing. Beaconing is periodic callbacks, C2 over HTTPS uses port 443, and DGA domains indicate automated C2 infrastructure.

Answer

DNS exfiltration

Answer

Port scanning

Question 13

An analyst identifies HTTP traffic containing the string "" in the URL parameter. Which TWO attack types are likely being attempted?

Accepted Answer

HTML injection. Option B (HTML injection) is correct because the payload consists of raw HTML tags () being inserted into a URL parameter, which is the defining characteristic of HTML injection — injecting markup into a page that renders it. Option D (Cross-site scripting, XSS) is correct because the specific payload is a classic reflected XSS proof-of-concept, where attacker-supplied JavaScript executes in a victim's browser context. The unmarked options do not belong: LDAP injection (A) targets directory queries with characters like )(|&, command injection (C) targets OS shell metacharacters such as ; | && to run system commands, and SQL injection (E) targets database queries using syntax like ' OR 1=1--, none of which match an HTML/JavaScript script tag payload.

Answer

LDAP injection

Answer

Command injection

Answer

SQL injection

Question 14

An analyst observes repeated TCP SYN packets to various ports on a target IP with no SYN-ACK responses. What type of scan is most likely being performed?

Accepted Answer

SYN scan. A SYN scan (half-open scan) sends TCP SYN packets to target ports and never completes the three-way handshake. When the port is closed, the target replies with RST; when open, it replies with SYN-ACK. The question states no SYN-ACK responses are observed, which is consistent with a SYN scan against closed/filtered ports or a scan where the attacker never acknowledges the SYN-ACK. Tools like Nmap's default -sS scan behave exactly this way, sending SYNs to many ports rapidly.

Answer

UDP scan

Answer

Ping sweep

Answer

TCP connect scan

Question 15

During alert triage, an analyst determines that an alert was triggered by legitimate administrative activity. How should this alert be classified?

Accepted Answer

False positive. A false positive is an alert that fires but does not represent actual malicious or unwanted activity. Since the alert was triggered by legitimate administrative activity, it is a false positive — the detection system incorrectly flagged benign behavior as suspicious.

Answer

True negative

Answer

False negative

Answer

True positive

Question 16

An analyst analyzing a PCAP sees a series of TCP connections where the client sends data with interactive patterns and receives commands. This is most likely indicative of:

Accepted Answer

Reverse shell. A reverse shell provides an interactive command-line session from the victim to the attacker.

Answer

Web browsing

Answer

File transfer

Answer

DNS query

Question 17

Which TWO of the following are valid classifications for alerts during triage?

Accepted Answer

True positive. In alert triage, a true positive (B) is a valid classification because it means the alert correctly identified a real malicious or policy-violating event that warrants investigation or response. A false positive (E) is also valid because it means the alert fired on benign activity, which is a common triage outcome that leads to tuning or closure. These two are the standard positive-alert classifications used to decide whether an event is an actual incident. Indeterminate (A) is not a standard triage classification, and true negative (C) and false negative (D) describe detection outcomes where no alert was raised, so they are not classifications of an alert during triage.

Answer

Indeterminate

Answer

True negative

Answer

False negative

Question 18

An analyst is triaging alerts and encounters a scenario where an IDS alerted on a network scan, but further investigation reveals the traffic was from a legitimate vulnerability scanner. Which TWO terms best describe this alert?

Accepted Answer

Benign trigger. Option D (False positive) is correct because the IDS generated an alert for activity that was not actually malicious — the traffic came from a legitimate vulnerability scanner, so the alert incorrectly flagged benign activity as an intrusion. Option B (Benign trigger) is correct because it describes the underlying cause: legitimate traffic (the authorized vulnerability scanner) triggered the IDS signature, producing a non-malicious alert. Option A (True negative) is wrong because a true negative means no alert was raised for benign activity, whereas here an alert did fire. Option C (False negative) is wrong because that would mean malicious activity occurred but the IDS failed to alert, which is the opposite of this scenario. Option E (True positive) is wrong because a true positive requires the alerted activity to be genuinely malicious, and the scanner traffic was legitimate.

Answer

True negative

Answer

False negative

Answer

True positive

Question 19

An analyst observes a host making outbound connections to a server on TCP port 443, with traffic patterns showing small packets at regular 60-second intervals. The destination IP is in a country where the company does no business. Which THREE characteristics suggest this is C2 beaconing?

Accepted Answer

Small packet sizes at regular 60-second intervals. Beaconing often uses HTTPS to evade detection, has periodic regular intervals, and goes to unusual destinations. Small packets at fixed intervals are classic.

Answer

Large file downloads

Answer

DNS queries for internal domains

Question 20

An analyst is examining a PCAP for signs of pass-the-hash attack. Which THREE indicators would be consistent with pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from the same host to many targets. Option B is correct because pass-the-hash tools such as Mimikatz, Impacket's psexec, or CrackMapExec typically spray NTLM authentication over SMB (TCP 445) from one compromised host to many targets, producing a fan-out pattern of SMB session setups and NTLMSSP negotiate/challenge/authenticate exchanges. Option D is correct because a successful NTLM logon that is immediately followed by file access (e.g., SMB tree connects, ADMIN$ or C$ share access, or service creation) demonstrates the attacker leveraging the stolen hash to reach resources without knowing the plaintext password. Option E is correct because pass-the-hash fundamentally abuses the NTLM protocol by replaying the captured NT hash in the NTLMSSP AUTHENTICATE message instead of a password-derived response, so PCAPs show NTLM authentication where the credential material is a hash. Option A is not relevant because large DNS queries are associated with DNS tunneling or exfiltration, not credential replay. Option C is not a pass-the-hash indicator because Kerberos ticket requests (AS-REQ/TGS-REQ) reflect Kerberos-based activity such as Kerberoasting or golden/silver ticket use, not NTLM hash reuse.

Answer

Large DNS queries

Answer

Kerberos ticket requests