200-201 Network Intrusion Analysis Practice Test 11 — 15 Questions

Question 1

During an intrusion investigation, an analyst needs to determine whether a specific internal host communicated with a known malicious IP address. The analyst has full packet capture for the relevant window but only wants to see the TCP stream from that host to the suspect address. Which Wireshark display filter isolates that conversation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip.addr == 10.10.5.20 && ip.addr == 203.0.113.77. Repeating the address field with the AND operator restricts output to packets where the two addresses appear in either direction, which captures the full bidirectional conversation. A direction-specific filter hides responses, adding a port constraint may exclude the actual traffic, and using OR broadens the result to unrelated hosts. The bidirectional address pair is the reliable way to isolate one conversation.

Answer

ip.src == 10.10.5.20 && ip.dst == 203.0.113.77

Answer

ip.addr == 10.10.5.20 || ip.addr == 203.0.113.77

Answer

tcp.port == 445 && ip.addr == 10.10.5.20

Question 2

An analyst monitoring an internal network observes a host sending a large number of TCP segments with the URG flag set and a non-zero urgent pointer, but the urgent pointer value does not point to actual urgent data. The destination host appears to be processing the data normally. Which explanation best describes what the analyst is observing?

Accepted Answer

An attacker is using the TCP urgent pointer as a covert signaling mechanism or IDS evasion technique. The TCP urgent pointer is rarely used by modern applications and is inconsistently handled by IDS engines and operating systems. Attackers exploit this by setting URG with a pointer that does not correspond to real urgent data, using the flag pattern as a covert signal to a cooperating peer or to desynchronize the IDS's view of the stream while the actual data is processed normally by the target.

Answer

The host is performing a legitimate Telnet session where urgent data indicates a break command

Answer

The host is experiencing a TCP window zero condition caused by application backpressure

Answer

The host is retransmitting segments because the receiver's ACKs are being lost in transit

Question 3

A SOC analyst is triaging an alert from a network sensor indicating that an internal host may be performing host discovery on the local subnet. The analyst wants to identify active hosts without generating TCP connections. Which two techniques should the analyst expect to see in the packet capture that are consistent with this goal? (Choose two.)

Accepted Answer

ICMP echo requests sent to each address in the subnet range. ICMP echo requests and ARP requests are both connectionless techniques that confirm host liveness without establishing TCP sessions. ICMP echo requests work across routed networks, while ARP requests are effective on the local subnet. Both avoid TCP state on targets, which matches the analyst's requirement. TCP SYN, TCP FIN, and targeted UDP probes either create TCP state or focus on service discovery rather than pure host liveness.

Answer

TCP SYN packets sent to port 80 on each address in the subnet

Answer

UDP datagrams sent to port 53 on each address in the subnet

Answer

TCP FIN packets sent to port 443 on each address in the subnet

Question 4

A SOC analyst is investigating a suspected ARP poisoning attack on a local subnet. Which two indicators would most strongly support this conclusion? (Choose two.)

Accepted Answer

A high rate of unsolicited ARP replies on the subnet. ARP poisoning is confirmed by layer-2 evidence: multiple IP addresses resolving to one MAC address in the ARP cache, and a high volume of unsolicited ARP replies. DNS query spikes, duplicate IP conflict messages, and TCP retransmissions may accompany network problems but are not specific to forged ARP activity, so they do not strongly support the conclusion.

Answer

An increase in TCP retransmissions across the subnet

Answer

Duplicate IP address conflict messages in system logs

Answer

A sudden increase in DNS query volume from a single host

Question 5

An analyst reviews a PCAP and sees a host receive an unsolicited ICMP echo reply containing an embedded payload, followed by the host initiating a TCP connection to an internal server on port 445. The ICMP payload begins with bytes that decode to a URL path. Which analysis conclusion is most defensible?

Accepted Answer

The ICMP payload is likely a covert channel delivering a command that triggered the SMB connection. An unsolicited ICMP echo reply carrying a decodable URL path is a hallmark of ICMP-based covert command delivery. Pairing it with a subsequent outbound SMB connection to an internal server suggests the delivered instruction told the host to reach a share for lateral movement or tool retrieval. The direction of the TCP handshake confirms the host is the client, and the payload is coherent, not a fragmentation artifact, so the covert-channel conclusion is the most defensible.

Answer

The ICMP payload is a fragmentation artifact and should be ignored

Answer

The ICMP traffic is a benign network health check and the SMB connection is unrelated

Answer

The SMB connection indicates the host is acting as a file server for the attacker

Question 6

An analyst examining a PCAP sees a host send an HTTP GET request where the User-Agent string contains a long, random-looking hexadecimal value, the request path includes a similarly random string, and the server responds with a 404 status code but a response body of several kilobytes. This pattern repeats every 60 seconds. Which activity is most likely occurring?

Accepted Answer

Command-and-control beaconing over HTTP with data hidden in request and response fields. The fixed 60-second cadence, random hex identifiers in both the User-Agent and URI, and a substantial response body paired with a 404 status together indicate HTTP-based command-and-control. Implants poll at set intervals for tasking, encode session identifiers to evade signatures, and hide instructions in what appears to be an error response. Normal CDN traffic, vulnerability scanning, and backoff retries all produce different timing, field content, and response characteristics.

Answer

A content delivery network serving cached assets to a browser with a corrupted user agent

Answer

A misconfigured application retrying a failed API call with exponential backoff

Answer

An automated vulnerability scanner fuzzing the web application

Question 7

A SOC analyst is investigating a suspected data exfiltration event on a corporate network. The analyst runs a Wireshark display filter on a captured PCAP and sees a large volume of outbound packets from an internal workstation to an external IP address, all with the same destination port and with the TCP PSH flag set on nearly every packet. The payloads are small but consistently sized, and the transfer continues for over 30 minutes. Which statement best explains why this traffic pattern is suspicious in the context of network intrusion analysis?

Accepted Answer

The steady, long-duration outbound flow with consistent packet sizes suggests a scripted or automated transfer, which is consistent with data exfiltration rather than normal interactive user activity.. The correct answer focuses on behavioral indicators: a long, steady, automated-looking outbound flow with uniform packet sizes and the PSH flag set on most packets. This pattern is typical of data exfiltration tools that chunk and push data continuously, unlike bursty interactive user traffic. The other options misattribute meaning to TCP flags or make incorrect claims about detection limits, which would mislead an analyst.

Answer

The PSH flag indicates the sender is bypassing TCP flow control, which is a known evasion technique used by rootkits to hide data in the TCP header.

Answer

The presence of the PSH flag on nearly every packet means the connection is using TCP Fast Open, which is only seen in malicious command-and-control channels.

Answer

The use of a single destination port for all outbound packets indicates the traffic is encrypted, and encrypted exfiltration cannot be detected by network analysis.

Question 8

An analyst is reviewing a PCAP of an intrusion and observes that the attacker's machine sent a TCP segment with the ACK flag set to a target host, but the target had never received a SYN from the attacker. The target responded with an RST. The analyst wants to determine what the attacker was attempting. Which technique best describes this activity?

Accepted Answer

An ACK scan used to map firewall rules and determine which ports are filtered. An ACK scan sends TCP segments with only the ACK flag set to ports where no session exists. Targets respond with RST if the port is reachable and unfiltered, while firewalls that filter the port may drop the packet silently. This allows the attacker to infer firewall rule sets rather than open services, which matches the observed segment and RST response.

Answer

A TCP SYN scan used to identify open ports on the target

Answer

A TCP session hijacking attempt using a spoofed sequence number

Answer

A Christmas tree scan used to identify open ports via illegal flag combinations

Question 9

An analyst is investigating a suspected FTP brute-force attack. The logs show numerous failed login attempts from a single external IP to multiple user accounts on an internal FTP server. Which two additional pieces of evidence would best confirm a brute-force attack? (Choose two.)

Accepted Answer

A high number of FTP 530 Login incorrect responses within a short time window.. The correct answers are a high number of FTP 530 Login incorrect responses within a short time window and threat intelligence linking the external IP to credential stuffing. These directly support the brute-force hypothesis: repeated failures indicate automated attempts, and threat intel provides context that the source is malicious.

Answer

The FTP server is configured to allow anonymous access.

Answer

The FTP server uses plaintext authentication.

Answer

The external IP has a low reputation score but no specific threat intelligence tags.

Question 10

While reviewing firewall logs, an analyst notices repeated inbound connections from a single external IP to multiple internal hosts on TCP port 3389 within a short time window. Each connection lasts only a few seconds and is followed by a new connection to a different internal host. Which activity does this pattern most likely represent?

Accepted Answer

A vulnerability scan of internal RDP services. One external source rapidly opening short-lived TCP/3389 sessions to many internal hosts is characteristic of scanning for exposed RDP services. Legitimate RDP administration uses longer authenticated sessions from internal management addresses, backups use different protocols, and health checks come from internal load balancers at regular intervals. The burst of brief, fan-out connections therefore points to reconnaissance against RDP endpoints.

Answer

A load balancer health check against RDP servers

Answer

An administrator using Remote Desktop to manage multiple servers

Answer

A backup application replicating data over RDP

Question 11

An analyst investigates a suspected data exfiltration event and captures outbound traffic from a compromised host. The traffic uses HTTPS to an unfamiliar external domain and shows consistent large uploads at regular intervals. Which two indicators would most strongly support the conclusion that this is automated exfiltration rather than normal user browsing? (Choose two.)

Accepted Answer

The uploads occur at fixed intervals with near-identical byte counts. Automated exfiltration is best identified by behavior: uploads at fixed intervals with near-identical sizes indicate a scheduled tool, and outbound data with no matching user-driven inbound requests shows the transfer is not interactive browsing. Domain age, certificate issuer, and TLS version describe infrastructure or protocol choices that legitimate and malicious traffic share, so they are weaker indicators and do not specifically demonstrate automation.

Answer

The connection uses TLS version 1.2

Answer

The TLS certificate uses a self-signed issuer

Answer

The destination domain was registered recently and has no reputation history

Question 12

During a network intrusion analysis, an analyst observes a series of TCP packets with the FIN flag set but no corresponding ACK, followed by packets with the RST flag set. What is the most likely explanation for this traffic pattern?

Accepted Answer

A TCP port scan using FIN and RST packets.. The correct answer is a TCP port scan using FIN and RST packets. A FIN scan sends packets with only the FIN flag; closed ports reply with RST, while open ports ignore them. The observed pattern of FIN packets without ACK followed by RST responses matches this stealthy scanning technique, which can bypass some firewalls.

Answer

A SYN flood denial-of-service attack.

Answer

A TCP session hijacking attempt.

Answer

A normal TCP connection termination sequence.

Question 13

During an investigation, an analyst observes that a workstation resolves an internal hostname to an IP address that does not match the DHCP lease record, and subsequent SMB connections to that hostname reach an attacker-controlled server. Which attack technique best explains this behavior?

Accepted Answer

DNS spoofing or rogue DNS response injection. A hostname resolving to an IP that contradicts the DHCP lease, followed by SMB traffic reaching an attacker server, points to manipulation of name resolution. DNS spoofing or rogue DNS responses inject false records so the client connects to the wrong endpoint. ARP poisoning operates at layer 2 with MAC mappings, DHCP starvation prevents lease acquisition, and SMB signing affects message integrity, so none of those explain the poisoned resolution.

Answer

SMB signing downgrade on the file server

Answer

DHCP starvation exhausting the address pool

Answer

ARP cache poisoning on the local subnet

Question 14

An analyst is investigating a suspected ARP poisoning attack on a local subnet. The analyst captures traffic and reviews ARP packets. Which two characteristics would most likely indicate that ARP poisoning is occurring? (Choose two.)

Accepted Answer

Multiple ARP replies from the same MAC address claiming different IP addresses. The correct indicators are multiple ARP replies from one MAC claiming different IPs and gratuitous ARP replies not preceded by a request. Both are hallmarks of ARP poisoning, where an attacker floods the network with forged ARP mappings to intercept traffic. Normal ARP requests are broadcast and are not malicious. The other options describe normal or invalid but non-indicative behavior.

Answer

ARP packets with a sender MAC address that is a multicast address

Answer

ARP request packets with a broadcast destination MAC address

Answer

ARP requests sent to a unicast destination MAC address

Question 15

A security analyst is examining a PCAP and observes a series of TCP packets with the PSH flag set and small payload sizes, sent from an internal host to an external IP. The packets are spaced roughly 30 seconds apart. Which type of malicious activity is MOST likely indicated?

Accepted Answer

A command-and-control (C2) beacon. The combination of small payloads, PSH flag, and regular 30-second intervals strongly suggests C2 beaconing. Malware often beacons to its C2 server at set intervals to receive commands or exfiltrate small amounts of data. This pattern is distinct from floods, file transfers, or scans.

Answer

A TCP SYN flood attack

Answer

A TCP port scan using FIN packets

Answer

A large file transfer using FTP