200-201 Network Intrusion Analysis Practice Test 10 — 15 Questions

Question 1

A junior analyst is asked to identify which log source would best confirm that an internal workstation attempted to resolve a suspicious domain shortly before an alert fired. The environment forwards DNS query logs from its recursive resolvers to the SIEM. Which action should the analyst take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query the forwarded DNS logs for the workstation's IP and the suspicious domain name.. When recursive resolver query logs are already centralized in the SIEM, searching them for the workstation's IP and the suspicious domain is the fastest authoritative way to confirm the lookup and its timestamp. Firewall logs show IP connections rather than names, reverse lookups describe the workstation itself, and the hosts file only covers static overrides, so none of those directly answer whether the domain was resolved.

Answer

Run a reverse DNS lookup on the workstation's IP address to see its registered name.

Answer

Inspect the workstation's local hosts file for static entries mapping the suspicious domain.

Answer

Search the firewall session logs for outbound connections to the suspicious domain's IP address.

Question 2

A SOC analyst is reviewing a packet capture from an internal web server and notices that a single external IP sent 4,000 TCP segments with the ACK flag set to a closed port, and each segment received a RST response. No SYN packets preceded these segments. Which type of scan is this host most likely performing?

Accepted Answer

TCP ACK scan. The scanner sent only ACK-flagged TCP segments to a closed port and received RST replies, which is the signature of an ACK scan used to probe firewall filtering rather than open services. A SYN scan would require an initial SYN, a FIN scan would use the FIN flag, and a UDP sweep would not produce TCP RST responses. The pattern uniquely identifies an ACK scan.

Answer

UDP port sweep

Answer

TCP SYN stealth scan

Answer

TCP FIN scan

Question 3

During network intrusion analysis, an analyst reviews a PCAP showing a series of TCP packets where the attacker sends an ACK with a sequence number outside the expected window, followed by packets with overlapping sequence ranges. The analyst suspects the attacker is attempting to evade an IDS by confusing its TCP stream reassembly. Which evasion technique is being used?

Accepted Answer

TCP segmentation overlap evasion. In TCP segmentation overlap evasion, the attacker deliberately crafts overlapping or out-of-window segments so that an IDS and the destination host disagree on the reassembled byte stream. The IDS may see harmless data while the host processes the malicious version, or vice versa. Normalizing and validating TCP streams is required for reliable detection.

Answer

TCP RST injection

Answer

TCP SYN flood

Answer

IP fragmentation attack

Question 4

A SOC analyst is reviewing NetFlow records and notices that a single internal host has initiated connections to 1,024 distinct destination IP addresses on TCP port 445 within a five-minute window. Each connection attempt lasts under one second and transfers fewer than three packets. Which activity does this pattern most strongly indicate?

Accepted Answer

SMB worm propagation scanning the local subnet and adjacent ranges. Rapid connections from one internal host to a large number of unique destinations on a single service port, each lasting only a moment and exchanging minimal data, is the signature of automated SMB scanning used for worm propagation. Legitimate SMB workloads target a small, stable set of servers and move meaningful data. NetFlow aggregation does not create destination diversity, and name resolution uses different ports and protocols, so the fan-out reflects real scanning behavior.

Answer

An SMB client resolving a hostname through repeated broadcast name queries

Answer

A legitimate backup application performing parallel SMB writes to storage nodes

Answer

A normal NetFlow sampling artifact caused by flow timeout settings

Question 5

An IDS alert indicates that a server received HTTP requests containing long strings of the form ../../../../etc/passwd in a URL parameter. The web server returned HTTP 200 responses to these requests. Which conclusion should the analyst draw while continuing the investigation?

Accepted Answer

The requests warrant deeper inspection of response bodies and server file access logs to determine whether traversal succeeded.. A traversal attempt returning HTTP 200 is suspicious but not conclusive, because the status code reflects request handling rather than file disclosure. Confirmation requires examining response bodies for sensitive file contents and correlating with server-side file access logs. The other choices either overstate the evidence as confirmed compromise, wrongly dismiss the alert, or mischaracterize traversal strings as normal browser behavior.

Answer

The alert is a false positive because directory traversal cannot appear in URL parameters.

Answer

The server is confirmed compromised because directory traversal strings were sent and accepted.

Answer

The activity is normal because web browsers routinely send relative path characters in requests.

Question 6

An analyst inspects a PCAP and sees an internal host sending HTTP requests where the User-Agent string is unusually long and contains random alphanumeric characters, and the Cookie header carries base64-like data to an external server. The server responds with small HTTP 200 OK messages. Which technique is most consistent with this traffic?

Accepted Answer

HTTP command-and-control beaconing with data exfiltration over headers. Randomized User-Agent strings and base64-encoded Cookie values sent to an external server, with small HTTP 200 responses, are characteristic of HTTP-based command-and-control where data is hidden in headers. Legitimate extension updates, proxy caching, and DNS over HTTPS all produce predictable, structured traffic that does not match the randomness or the request-response pattern observed.

Answer

A misconfigured web proxy caching responses

Answer

A legitimate browser extension updating its configuration

Answer

DNS over HTTPS resolution performed by the host

Question 7

An analyst inspects a PCAP and finds a TCP stream where the client and server exchange data in alternating small chunks, each packet's payload is roughly 40 to 60 bytes, and the conversation lasts over two hours with consistent inter-packet delays of about ten seconds. The destination port is 443 but the payload is not TLS. Which conclusion is best supported?

Accepted Answer

The traffic is a reverse shell or command-and-control channel using interactive command semantics. Long-lived sessions with alternating short payloads and a steady interval are characteristic of interactive command-and-control or reverse shells, where each message carries a command or its output. Bulk transfers, TLS cipher negotiation, and DNS-over-HTTPS all produce different payload sizes, framing, and timing. The use of port 443 without TLS framing strengthens the conclusion that the port is being used to evade egress filtering rather than for legitimate web traffic.

Answer

The traffic is a large file transfer that has been fragmented by the network

Answer

The traffic is a DNS-over-HTTPS session resolving names for a busy client

Answer

The traffic is a misconfigured TLS session negotiating an unusually small cipher block

Question 8

An analyst is triaging a suspected FTP brute-force campaign against an internal server. The IDS reports many failed authentication attempts from a single external address. Which TWO data points, gathered from the FTP server and network logs, most directly support confirming and characterizing the attack? (Choose two.)

Accepted Answer

Count of distinct usernames attempted and the number of failed 530 responses per source IP over time.. Confirming and characterizing an FTP brute-force campaign depends on authentication telemetry: the number of distinct usernames and failed response codes per source IP shows the attack's shape and rate, while a successful login from the same source after repeated failures confirms compromise. Certificate expiry, historical transfer sizes, and daemon patch level describe configuration or baseline behavior and cannot establish whether the attack occurred or succeeded.

Answer

The average size of files previously transferred by legitimate users of the FTP service.

Answer

The server's TLS certificate expiration date for FTPS connections.

Answer

The server's operating system patch level for the FTP daemon.

Question 9

A SOC analyst is investigating a suspected network intrusion and reviews NetFlow records. The analyst observes a sudden increase in outbound traffic from a single internal host to an external IP address, with large data volumes during off-hours. Which two additional indicators should the analyst examine to confirm data exfiltration? (Choose two.)

Accepted Answer

The duration and consistency of the outbound flow to the external IP. To confirm exfiltration from flow records, the analyst should look at the outbound-to-inbound byte ratio and the duration and consistency of the outbound flow. A high ratio and a sustained, consistent transfer to the same external IP, especially during off-hours, strongly support data exfiltration. Port counts, benign DNS queries, and failed logins are less directly related to confirming outbound data theft.

Answer

The number of distinct destination ports contacted by the internal host

Answer

The number of failed login attempts on the internal host

Answer

The presence of repeated DNS queries to known benign domains

Question 10

A network analyst is reviewing firewall logs and sees repeated inbound connections from a single external IP to TCP port 445 on multiple internal hosts over a short period. The connections are followed by SMB negotiation attempts. Which activity does this most likely represent?

Accepted Answer

SMB enumeration or exploitation attempts against internal file-sharing services. Inbound SMB connections to TCP port 445 from one external IP across many internal hosts indicate enumeration or exploitation of file-sharing services. Backup traffic, legitimate VPN-based file access, and DNS zone transfers have different source, port, and pattern characteristics. The sweep across multiple hosts in a short time is the key indicator of malicious SMB activity.

Answer

A backup server replicating data to internal hosts

Answer

DNS zone transfer requests to internal DNS servers

Answer

Normal SMB file access by remote employees using VPN

Question 11

An analyst reviews an IDS alert indicating a TCP SYN scan against a web server. The analyst wants to confirm the scan by examining packet-level evidence in the PCAP. Which TWO characteristics would confirm a SYN scan rather than legitimate client behavior? (Choose two.)

Accepted Answer

The source sends SYN packets with varying TCP window sizes and random source ports across the scan. A SYN scan is proven by the combination of incomplete handshakes across many destination ports and deliberate header variation. The scanner never finishes the three-way handshake, and it randomizes source ports and window sizes to evade detection. Target responses such as RST or SYN-ACK merely reflect normal TCP behavior, a completed handshake indicates legitimate client activity, and historical firewall blocks are reputation context rather than packet-level confirmation.

Answer

The source sends a single SYN and then completes the handshake before sending an HTTP GET

Answer

The target's firewall logs show the source IP was previously blocked for port scanning

Answer

The destination responds with RST packets for closed ports and SYN-ACK for open ports

Question 12

An analyst is reviewing a PCAP and observes a TCP stream where the client sends a packet with the PSH and ACK flags set, containing an HTTP GET request. The server responds with a packet with the FIN and ACK flags set, but the client continues to send data. Later, the client sends a packet with the RST flag set. Which statement best describes what is happening?

Accepted Answer

The server is initiating a graceful connection termination, but the client is ignoring it and continuing to send data, eventually forcing a reset.. The server's FIN+ACK indicates it wants to close its half of the connection. The client should respond with a FIN and stop sending data. Instead, the client continues to send data, which is a TCP protocol violation. The eventual RST from the client abruptly terminates the connection. This behavior could be due to a buggy application, a misconfigured client, or a deliberate attempt to cause a reset.

Answer

The client is using TCP fast open, which allows data transmission after the server sends FIN.

Answer

The server is experiencing a denial-of-service condition because the client is flooding it with data after the FIN.

Answer

The client is performing a TCP reset attack to terminate the connection prematurely.

Question 13

An analyst notices that an internal host is sending periodic ICMP echo requests to an external IP, and the echo replies contain payloads that are longer than the default Windows ping payload. The payload bytes appear to be encoded and change with each reply. Which activity is most likely occurring?

Accepted Answer

ICMP tunneling used for command-and-control or data transfer. Non-default ICMP payload sizes with changing encoded bytes in echo replies indicate that data is being tunneled inside ICMP, a common covert channel for command-and-control or exfiltration. Latency measurement, path MTU discovery, and Smurf attacks produce different packet characteristics and do not involve variable encoded payloads in replies.

Answer

Path MTU discovery performed by the host

Answer

Network latency measurement by a monitoring tool

Answer

Smurf attack reflection against the external host

Question 14

A network analyst is examining a PCAP and sees a large number of ICMP echo request packets sent from a single internal host to multiple external IP addresses, with varying payload sizes and no corresponding echo replies. The analyst suspects the host is being used for reconnaissance or data exfiltration. Which characteristic of the ICMP traffic would most strongly indicate that it is being used for data exfiltration rather than simple reconnaissance?

Accepted Answer

The ICMP packets contain non-standard payload data that is base64-encoded and varies in length.. The presence of non-standard, base64-encoded payload data that varies in length is a classic sign of ICMP tunneling for data exfiltration. Normal ping requests have predictable payloads, often just a repeating pattern or timestamp. When ICMP is used as a covert channel, the payload carries encoded stolen data, making the traffic anomalous. The other options describe patterns more consistent with reconnaissance or benign monitoring.

Answer

The payload sizes are consistent and small, matching standard ping requests.

Answer

The source IP address is spoofed to match the destination IP address.

Answer

The ICMP echo requests are sent at a constant rate of one per second to a single external IP.

Question 15

A SOC analyst monitors outbound traffic from a corporate network and notices a single internal host contacting an external server on TCP port 53, but the payloads contain fixed-length, non-DNS binary data with no query/response structure. The host also makes outbound connections to the same external IP on TCP port 4444. Which technique is the attacker most likely using?

Accepted Answer

Command-and-control over a non-standard port masquerading as DNS. Traffic to TCP port 53 that does not follow DNS message formatting, combined with a second connection to TCP port 4444, indicates a custom command-and-control channel deliberately placed on a commonly permitted port. Attackers choose such ports to slip past egress filters that allow DNS. DNS tunneling and DoH would preserve DNS semantics or use TLS on 443, and SMTP abuse would use mail ports and commands, none of which match the observed binary, non-DNS payloads.

Answer

DNS over HTTPS (DoH) tunneling

Answer

SMTP relay abuse for data exfiltration

Answer

DNS tunneling over TCP port 53