200-201 Network Intrusion Analysis Practice Test 4 — 15 Questions

Question 1

In the Cyber Kill Chain, which phase involves sending a malicious attachment to a targeted user?

Accepted Answer

Delivery. The delivery phase is when the attacker transmits the weaponized payload to the target, e.g., via email attachment.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 2

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive occurs when an alert is triggered but no actual attack exists. The file is benign, so the alert is incorrect.

Answer

True positive

Answer

False negative

Answer

True negative

Question 3

During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?

Accepted Answer

RST. In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.

Answer

ICMP Port Unreachable

Answer

ACK

Answer

SYN-ACK

Question 4

Which type of attack is indicated by a series of SMB authentication attempts from one host to multiple other hosts in a short time frame?

Accepted Answer

Lateral movement. Lateral movement often involves propagating across hosts using SMB for remote access and authentication.

Answer

Port scanning

Answer

C2 beaconing

Answer

DNS exfiltration

Question 5

A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:

Accepted Answer

Beaconing using DGA. Domain Generation Algorithms (DGA) are used to generate many domain names to evade blocklists, and C2 servers may use HTTPS with varying IPs.

Answer

Exfiltration via FTP

Answer

DNS tunnelling

Answer

Port scanning

Question 6

A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:

Accepted Answer

SQL injection. SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.

Answer

Cross-site scripting

Answer

Path traversal

Answer

Command injection

Question 7

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The tcp.stream filter allows viewing a specific TCP stream by its number, which is useful for analysis.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 8

A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:

Accepted Answer

DNS tunnelling for exfiltration. DNS exfiltration encodes data in subdomain names to bypass security controls, as DNS is often allowed through firewalls.

Answer

Port scan via DNS

Answer

Normal DNS resolution

Answer

DGA-based C2

Question 9

In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?

Accepted Answer

Reverse shell payload. Reverse shells create interactive shell sessions over a TCP connection, often used by attackers to control compromised hosts.

Answer

File transfer tool

Answer

Port scanner

Answer

SQL injection tool

Question 10

An alert shows a high volume of outbound traffic from an internal host to an external IP using FTP. The data includes files with names matching internal document names. This activity is most likely:

Accepted Answer

Data exfiltration. Exfiltration via FTP is a common technique to steal data by transferring it to an external server.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Port scanning

Question 11

In Wireshark, which filter can be used to quickly find all HTTP requests that contain a specific keyword in the URL?

Accepted Answer

http.request.uri contains "keyword". The http.request filter combined with a contains operator can isolate HTTP requests with specific patterns.

Answer

dns.qry.name contains "keyword"

Answer

tcp.port == 80

Answer

ip.src == 10.0.0.1

Question 12

Which MITRE ATT&CK tactic corresponds to the Cyber Kill Chain phase 'Actions on Objectives'?

Accepted Answer

Impact. In MITRE ATT&CK, the tactic 'Impact' covers actions that disrupt or damage systems, similar to 'Actions on Objectives' where the attacker achieves their goal.

Answer

Privilege Escalation

Answer

Command and Control

Answer

Exfiltration

Question 13

A security analyst is investigating a PCAP that shows multiple failed SMB authentication attempts from a single host to different IP addresses, followed by a successful authentication. Which TWO techniques are likely being used?

Accepted Answer

SMB brute force. Pass-the-hash uses NTLM hashes for authentication, and SMB brute force involves trying multiple passwords or hashes. Both can produce multiple failed attempts then success.

Answer

SQL injection

Answer

ARP spoofing

Answer

DNS tunnelling

Question 14

A PCAP contains the following patterns: (1) A TCP connection with a complete handshake to an external IP on port 443, (2) periodic data transfers every 60 seconds of approximately 1 KB, (3) the domain name in the TLS SNI field is generated by a DGA. Which THREE indicators are present?

Accepted Answer

Beaconing. Beaconing is periodic callbacks, C2 over HTTPS uses port 443, and DGA domains indicate automated C2 infrastructure.

Answer

DNS exfiltration

Answer

Port scanning

Question 15

An analyst identifies HTTP traffic containing the string "" in the URL parameter. Which TWO attack types are likely being attempted?

Accepted Answer

HTML injection. The script tag is classic XSS; HTML injection occurs when attacker injects HTML content.

Answer

LDAP injection

Answer

Command injection

Answer

SQL injection