200-201 Network Intrusion Analysis Practice Test 3 — 15 Questions

Question 1

A SOC analyst is reviewing a packet capture from a suspected compromised host. The capture shows a single TCP session where the client sends a crafted packet with the SYN, FIN, and PSH flags all set simultaneously to a closed port on a server, and the server responds with a single RST/ACK. No further packets are exchanged for that session. Which type of scan does this activity most likely represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP Xmas scan. The scan uses a malformed TCP flag combination against a closed port, prompting an RST/ACK without any handshake. This matches the stealthy Xmas-style scan family, where unusual flag sets are used to evade simple filters and elicit responses from closed ports. A connect scan would complete the handshake, a SYN scan would use only SYN, and a UDP scan would not produce TCP RST/ACK responses.

Answer

TCP SYN scan

Answer

TCP connect scan

Answer

UDP scan

Question 2

An analyst is examining a PCAP and observes a series of TCP segments where the client sends a request to a server, and the server responds with a single packet containing multiple HTTP responses concatenated together. The server's response includes two separate HTTP/1.1 200 OK status lines and corresponding bodies. The client's initial request contained a 'Connection: keep-alive' header. What is the most likely explanation for this traffic pattern?

Accepted Answer

HTTP pipelining. HTTP pipelining is the correct explanation because it enables a client to send multiple requests over one TCP connection, and the server responds with multiple HTTP responses that can be concatenated in a single TCP segment. The 'Connection: keep-alive' header supports persistent connections, which is a prerequisite for pipelining. The other options describe attacks or technologies that do not produce multiple HTTP/1.1 responses in one packet.

Answer

HTTP/2 server push

Answer

TCP segmentation offload (TSO) artifact

Answer

HTTP response splitting

Question 3

An analyst is reviewing a PCAP of an intrusion and sees a sequence where the attacker sends a TCP segment with the FIN flag set to a target host, and the target responds with a segment containing the RST flag. The attacker repeats this against multiple ports on the same host. Which conclusion is most accurate about this activity?

Accepted Answer

The attacker is performing a FIN scan to identify open ports.. Sending TCP segments with only the FIN flag and receiving RST from closed ports is the defining behavior of a FIN scan. Open ports typically do not respond to FIN segments, so the pattern of RST replies across many ports indicates closed ports and confirms scanning. The absence of a handshake rules out connect scans, and the flag used rules out ACK and UDP scans.

Answer

The attacker is performing a UDP scan.

Answer

The attacker is performing an ACK scan to map firewall rules.

Answer

The attacker is performing a TCP connect scan.

Question 4

A network analyst is examining a PCAP and notices a large number of ICMP echo requests sent from a single internal host to multiple external IP addresses. Each request has a small payload, and the responses are not received. The host is not a known network management server. Which type of activity does this most likely indicate?

Accepted Answer

Ping sweep. The host is sending ICMP echo requests to many different external IP addresses without receiving responses. This is a classic ping sweep, used to identify live hosts on a network. It is a reconnaissance technique often seen in the early stages of an attack. A flood would target one host, a Smurf attack uses broadcast, and ICMP redirects are a different message type.

Answer

Smurf attack

Answer

ICMP flood

Answer

ICMP redirect

Question 5

An analyst is examining a PCAP and observes a TCP session where the client sends a packet with the PSH flag set and a sequence number of 1000, and the server responds with an ACK acknowledging sequence number 1500. What does this indicate about the data transfer?

Accepted Answer

The client sent 500 bytes of data, and the server acknowledged receipt.. The correct answer is that the client sent 500 bytes and the server acknowledged receipt. The server's ACK number (1500) minus the client's initial sequence number (1000) equals 500, representing the number of bytes sent. The PSH flag indicates the data should be delivered to the application immediately.

Answer

The client sent a TCP segment with no data, and the server acknowledged it.

Answer

The client's packet was a retransmission, and the server acknowledged previously received data.

Answer

The client sent 1500 bytes of data, and the server acknowledged receipt.

Question 6

An analyst is examining a PCAP and notices that an internal web server is sending TCP segments with the PSH and ACK flags set to an external client, and each segment carries exactly 1 byte of application data. The analyst also observes that the server sends a separate segment for each byte rather than coalescing data. Which behaviour is the analyst most likely observing?

Accepted Answer

Interactive command-and-control over TCP where the server is the victim. A stream of PSH-ACK segments carrying exactly one byte each from an internal server to an external host is a strong indicator of an interactive channel, such as a reverse shell. The PSH flag forces immediate delivery, and the one-byte writes minimize latency for command and response. This pattern is atypical for normal HTTP streaming, which uses MTU-sized segments.

Answer

Normal HTTP response streaming from the web server

Answer

A slowloris denial-of-service attack against the external client

Answer

A TCP segmentation offload failure on the server NIC

Question 7

An analyst observes a series of TCP sessions where the client and server exchange data with window sizes that gradually increase, then the client sends a segment with the ACK flag set and a sequence number that is lower than the previously acknowledged sequence number, followed by a RST from the server. The client then immediately re-establishes a session with a different source port. Which network intrusion technique is most consistent with this pattern?

Accepted Answer

TCP session hijacking. The critical clue is the ACK segment with a sequence number lower than the previously acknowledged one, which indicates an attempt to inject data into an existing session by guessing sequence numbers. The server's RST and the client's immediate reconnection with a new source port are typical consequences of a session hijacking attempt that disrupted the legitimate connection. SYN flood and port redirection do not produce this specific sequence anomaly.

Answer

TCP sequence number prediction attack

Answer

TCP port redirection

Answer

TCP SYN flood

Question 8

An analyst is investigating an alert for a suspected ARP poisoning attack on the internal network. The analyst captures traffic and wants to confirm the attack. Which two indicators would most strongly support the conclusion that ARP poisoning is occurring? (Choose two.)

Accepted Answer

Multiple different IP addresses map to the same MAC address in the ARP cache of several hosts. ARP poisoning works by sending forged ARP replies that bind an attacker's MAC address to a legitimate IP such as the default gateway. The two strongest confirmations are duplicate IP-to-MAC mappings across hosts and a high rate of unsolicited broadcast ARP replies. Together they show that a single device is claiming multiple IP addresses and actively rewriting the ARP caches of its neighbors.

Answer

DHCP Discover messages are broadcast from multiple hosts simultaneously

Answer

DNS responses contain a mismatched transaction ID compared to the query

Answer

The default gateway's MAC address changes frequently in the ARP table of a workstation

Question 9

A network analyst is reviewing logs and notices a large number of ARP requests for the same IP address from different MAC addresses on the local subnet. Which type of attack does this most likely indicate?

Accepted Answer

ARP spoofing. The correct answer is ARP spoofing because the flood of ARP requests for the same IP from different MAC addresses indicates an attacker is sending forged ARP replies to poison the ARP cache of other hosts, redirecting traffic. This is a common technique for man-in-the-middle attacks on local networks.

Answer

VLAN hopping

Answer

DHCP starvation

Answer

MAC flooding

Question 10

An analyst is reviewing logs from a Cisco IOS router and notices a large number of syslog messages indicating that the router is receiving packets with the same source IP address but different source ports, all destined to a single internal web server on port 443. The messages also show that the router's ARP cache has multiple entries for that same IP address but different MAC addresses. Which type of attack is most likely occurring?

Accepted Answer

ARP spoofing. The presence of multiple ARP cache entries mapping the same IP address to different MAC addresses is a definitive sign of ARP spoofing. An attacker is likely poisoning the router's ARP cache to intercept or redirect traffic destined for the web server. The high volume of packets to port 443 may be a consequence of the redirection or the attacker's own connections. MAC flooding, DHCP starvation, and VLAN hopping do not produce this specific ARP cache symptom.

Answer

MAC flooding

Answer

VLAN hopping

Answer

DHCP starvation

Question 11

An analyst is examining a PCAP of an intrusion and notices a series of TCP segments where the sender's sequence numbers increase by exactly the segment's payload length, but the receiver's acknowledgments repeatedly acknowledge the same sequence number. The sender continues transmitting new data without retransmitting. Which condition best describes what the analyst is observing?

Accepted Answer

A TCP session where the receiver's window has been reduced to zero and the sender is ignoring the window, continuing to send new data.. The correct answer identifies a sender that continues to transmit new data despite the receiver repeatedly acknowledging the same sequence number, which is consistent with the sender ignoring a zero-window condition. This violates TCP flow control. The other options describe different TCP behaviors—zero-window probing, duplicate ACKs from out-of-order delivery, or spoofed ACKs—that do not match the observed pattern of new data with non-advancing ACKs.

Answer

A duplicate ACK scenario caused by out-of-order delivery, where the receiver keeps acknowledging the last in-order byte while the sender sends new data.

Answer

A TCP session where the receiver is acknowledging data it has not yet received, which indicates a spoofed ACK injection by an attacker.

Answer

A zero-window condition where the receiver's buffer is full and the sender is probing with new data instead of retransmitting.

Question 12

A security analyst is investigating a suspected network intrusion and has captured traffic showing a series of TCP segments with the URG flag set and a non-zero urgent pointer, followed by data that appears to be shell commands. The analyst suspects the attacker is using TCP urgent data to bypass intrusion detection systems. Which two characteristics of TCP urgent data should the analyst consider when analyzing this traffic? (Choose two.)

Accepted Answer

Many intrusion detection systems do not reassemble or inspect TCP urgent data, allowing attackers to hide payloads.. The two key considerations are that many IDS do not properly inspect TCP urgent data, allowing hidden payloads, and that the urgent pointer can be manipulated to cause misinterpretation of the data stream. These factors enable attackers to bypass detection. The other options are either definitional but not relevant, overgeneralized, or incorrect regarding encryption.

Answer

The urgent pointer indicates the sequence number of the byte following the urgent data.

Answer

TCP urgent data is always delivered out-of-band and is never seen by the receiving application's normal read calls.

Answer

TCP urgent data is encrypted by default, preventing inspection by network security tools.

Question 13

A network analyst is examining a PCAP and sees a TCP session where the client sends a packet with the SYN flag set, the server responds with SYN-ACK, and the client then sends an ACK. Immediately after, the client sends a packet with the RST flag set, terminating the connection. No application data is exchanged. What is the most likely explanation for this sequence?

Accepted Answer

A TCP port scan. The correct answer is a TCP port scan because the sequence of a completed three-way handshake followed immediately by a RST without any application data is characteristic of a TCP connect scan. Scanning tools often use this method to determine if a port is open. The other options describe different scenarios that would involve either incomplete handshakes, application data, or external RST injection.

Answer

A TCP reset attack

Answer

A failed application connection

Answer

A TCP SYN flood attack

Question 14

An analyst is reviewing a PCAP and notices a series of TCP packets where the client sends data with the PSH flag set, and the server responds with ACKs but no data. The client's data payloads are small (around 100 bytes) and contain commands like 'whoami' and 'dir'. The server's ACKs have no payload. The TCP window size advertised by the server is consistently large. What type of activity is most likely occurring?

Accepted Answer

Reverse shell. The correct answer is a reverse shell because the client (likely a compromised host) is sending interactive commands to a server, which acknowledges but does not send data until it issues its own commands. This pattern is typical of a reverse shell where the victim initiates the connection to the attacker. The other options describe different types of remote access or network configurations that do not match the observed command-and-control traffic.

Answer

Bind shell

Answer

Port forwarding

Answer

Telnet session

Question 15

A security analyst is reviewing a PCAP from a suspected network intrusion and wants to identify signs of an ARP cache poisoning attack. Which two indicators in the packet capture would most strongly support this conclusion? (Choose two.)

Accepted Answer

Multiple ARP replies from the same MAC address claiming to own different IP addresses on the local subnet.. The two strongest indicators are multiple ARP replies from one MAC claiming different IPs, and ARP replies sent without a preceding request. Both reflect the core mechanism of ARP cache poisoning: forging mappings to redirect traffic. The other options describe normal ARP behaviors (DAD probes, unicast requests) or a non-existent field, and thus do not support the conclusion.

Answer

A high volume of ARP requests broadcast to the entire subnet with the sender's IP set to 0.0.0.0.

Answer

ARP packets that contain a vendor-specific option field with a length greater than zero.

Answer

ARP requests that are unicast to a single host instead of broadcast to the subnet.