200-201 Network Intrusion Analysis Practice Test 2 — 15 Questions

Question 1

An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?

Accepted Answer

Multiple SMB connection attempts from a single host to many different hosts. Lateral movement via SMB often involves many SMB connections from one host to others, and pass-the-hash uses NTLM authentication with a hash.

Answer

A single SMB connection to a file server

Answer

DNS queries for internal hostnames

Answer

HTTP requests to a web server

Question 2

A security analyst observes repeated ICMP port unreachable responses from a target host. The source IP is sending packets to multiple UDP ports. Which type of scan is most likely being performed?

Accepted Answer

UDP scan. UDP scans elicit ICMP port unreachable messages from closed ports; open ports typically do not respond.

Answer

TCP SYN scan

Answer

TCP connect scan

Answer

Ping sweep

Question 3

During an intrusion analysis, a SOC analyst reviews logs showing an outbound connection from an internal host to an external IP at 03:00 AM every 60 seconds. The traffic is HTTPS to a suspicious domain with a high entropy name. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Command and Control (C2). Regular beaconing to an external domain indicates command and control (C2) communication.

Answer

Actions on Objectives

Answer

Delivery

Answer

Weaponisation

Question 4

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees in the URI. What is the most accurate classification of this alert?

Accepted Answer

True positive. The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.

Answer

False negative

Answer

False positive

Answer

True negative

Question 5

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

Accepted Answer

SQL injection. SQL injection attacks often include SQL keywords like UNION and SELECT in crafted parameters.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

Command injection

Question 6

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Answer

Golden ticket

Answer

Kerberoasting

Answer

Pass-the-ticket

Question 7

An analyst observes a series of DNS queries for subdomains like 'ZGVzdGluYXRpb24= .malicious.com' where the subdomain part appears base64-encoded. The volume of DNS traffic from a single host is unusually high. Which exfiltration technique is most likely in use?

Accepted Answer

DNS tunnelling. DNS exfiltration encodes data in subdomain queries to bypass traditional monitoring.

Answer

FTP exfiltration

Answer

HTTP POST exfiltration

Answer

Steganography in images

Question 8

During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?

Accepted Answer

Heap spray. Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.

Answer

Return-oriented programming (ROP)

Answer

Shellcode injection

Answer

Stack buffer overflow

Question 9

A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?

Accepted Answer

False positive. The alert fired on a pattern that resembles SQL injection, but the server was not vulnerable or the input was sanitized; thus no actual attack occurred.

Answer

True negative

Answer

False negative

Answer

True positive

Question 10

An analyst captures traffic and sees a TCP connection with only a SYN packet and an RST response. No SYN-ACK is observed. Which scan technique is this?

Accepted Answer

TCP SYN scan. A SYN scan sends a SYN and expects a SYN-ACK; if an RST is received, the port is closed. Incomplete handshake without SYN-ACK indicates a half-open scan.

Answer

Ping sweep

Answer

UDP scan

Answer

TCP connect scan

Question 11

A threat hunter identifies a binary that uses a Domain Generation Algorithm (DGA) to create domain names like 'eksdghf23.com', 'mzncxv89.net' each day. The malware contacts these domains over HTTPS. Which phase of the Cyber Kill Chain is most directly associated with this technique?

Accepted Answer

Command and Control. DGA domains are used to maintain resilient command and control infrastructure, which falls under the C2 phase.

Answer

Installation

Answer

Exploitation

Answer

Actions on Objectives

Question 12

An analyst reviews network logs and sees a large outbound FTP transfer of 500 MB from a workstation to an external IP at 2:00 AM. The workstation regularly sends 10 MB daily. What should the analyst suspect?

Accepted Answer

Data exfiltration. Large outbound data transfers outside normal patterns, especially at odd hours, are typical of data exfiltration.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Software update

Question 13

An analyst filters PCAP with 'tcp.stream eq 0' and sees an interactive shell session with commands like 'whoami', 'ls -la', 'cd /etc'. The session originated from an HTTP POST to a web shell. Which type of attack is this?

Accepted Answer

Reverse shell. A web shell allows remote command execution over HTTP, essentially a reverse shell.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Cross-site scripting

Question 14

A SOC analyst is investigating a suspected data exfiltration. Which THREE indicators in network traffic are most consistent with exfiltration? (Choose three.)

Accepted Answer

Large outbound data transfers to an external IP at unusual hours. Large outbound data transfers to an external IP at unusual hours (A) are a classic indicator of data exfiltration because attackers often move stolen data during off-peak times to evade detection. This behavior deviates from normal business traffic patterns and can be flagged by network monitoring tools as anomalous. The volume and timing together suggest intentional data theft rather than routine operations.

Answer

Consistent HTTPS traffic to a CDN

Answer

Increased inbound web traffic

Question 15

An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)

Accepted Answer

ROP gadgets. Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.

Answer

NOP sled

Answer

Heap spray

Answer

DNS tunnelling