200-201 Network Intrusion Analysis — 25 Questions

Question 1

During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?

Accepted Answer

Reconnaissance. The SYN scan is a reconnaissance technique used to identify open ports without completing the TCP handshake. The RST response indicates the port is closed, and the lack of ACK means the handshake was intentionally not completed, characteristic of a SYN scan.

Answer

Delivery

Answer

Weaponization

Answer

Exploitation

Question 2

An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?

Accepted Answer

UDP scan; true positive. UDP scans send UDP packets; closed ports respond with ICMP Port Unreachable. This matches the alert signature, indicating a true positive for a UDP scan.

Answer

TCP SYN scan; true positive

Answer

UDP scan; false positive

Answer

TCP connect scan; true negative

Question 3

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. SQL injection often involves injecting SQL keywords like UNION or SELECT into parameters. 'id=1 UNION SELECT' is a classic example.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 4

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

Accepted Answer

DNS tunnelling for C2 communication. DNS tunnelling encodes data in subdomain queries, and periodic beaconing is common for C2. High entropy subdomains and regular intervals suggest DNS tunnelling for C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for a dynamic DNS service

Answer

DNS cache poisoning attempt

Question 5

During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?

Accepted Answer

Delivery. The file contains shellcode and is extracted from network traffic, indicating it was delivered to the target. This aligns with the delivery phase.

Answer

Installation

Answer

Actions on Objectives

Answer

Weaponization

Question 6

An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?

Accepted Answer

Pass-the-hash attack. Pass-the-hash uses NTLM hashes to authenticate without the plaintext password. SMB authentication with hashes is a classic sign.

Answer

Brute force attack

Answer

Kerberos golden ticket attack

Answer

SMB relay attack

Question 7

A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?

Accepted Answer

Credential theft via phishing. Plaintext credentials in HTTP POST bodies indicate credential theft, possibly via phishing or a compromised web form.

Answer

Cross-site scripting (XSS)

Answer

Brute force attack

Answer

SQL injection

Question 8

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 9

An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?

Accepted Answer

Actions on Objectives. Exfiltration of sensitive data is part of 'Actions on Objectives', where the attacker achieves their goal of stealing data.

Answer

Installation

Answer

C2

Answer

Exploitation

Question 10

A security analyst is reviewing PCAP data and sees a TCP stream with interactive shell commands such as 'whoami', 'ls -la', and 'cat /etc/passwd'. The session appears to be bidirectional with a remote IP. Which type of attack is most likely occurring?

Accepted Answer

Reverse shell. Interactive shell commands over TCP indicate a reverse shell, where the attacker has a command shell on the victim.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 11

An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?

Accepted Answer

False positive. The alert triggered but there was no actual attack, so it is a false positive.

Answer

True negative

Answer

False negative

Answer

True positive

Question 12

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 13

A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?

Accepted Answer

DNS responses with unusually large TXT record sizes. DNS exfiltration involves encoding data in subdomain queries, often with high entropy, and can use TXT records to retrieve data.

Answer

Large number of ICMP echo requests to external hosts

Answer

Consistent traffic to a known C2 server on port 443

Answer

Multiple failed HTTP POST requests to a file-sharing site

Question 14

An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?

Accepted Answer

Return-oriented programming (ROP) gadget chains in data. Exploitation indicators include shellcode patterns (NOP sleds, ROP gadgets) and heap spray (large blocks of similar data).

Answer

Regular HTTP GET requests to a news website

Answer

DNS requests for common websites like google.com

Question 15

An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?

Accepted Answer

Multiple SMB connection attempts from a single host to many different hosts. Lateral movement via SMB often involves many SMB connections from one host to others, and pass-the-hash uses NTLM authentication with a hash.

Answer

A single SMB connection to a file server

Answer

DNS queries for internal hostnames

Answer

HTTP requests to a web server

Question 16

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

Accepted Answer

UDP scan. UDP scans elicit ICMP port unreachable messages from closed ports; open ports typically do not respond.

Answer

TCP SYN scan

Answer

TCP connect scan

Answer

Ping sweep

Question 17

During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control (C2). Regular beaconing to an external domain indicates command and control (C2) communication.

Answer

Actions on Objectives

Answer

Delivery

Answer

Weaponisation

Question 18

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees in the URI. What is the most accurate classification of this alert?

Accepted Answer

True positive. The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.

Answer

False negative

Answer

False positive

Answer

True negative

Question 19

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

Accepted Answer

SQL injection. SQL injection attacks often include SQL keywords like UNION and SELECT in crafted parameters.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

Command injection

Question 20

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Answer

Golden ticket

Answer

Kerberoasting

Answer

Pass-the-ticket