200-201 Network Intrusion Analysis Practice Test 5 — 15 Questions

Question 1

During the Cyber Kill Chain, which phase involves sending a malicious attachment to a target user via email?

Accepted Answer

Delivery. Delivery is the phase where the attacker transmits the weaponized payload to the target, such as via email attachments.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 2

An analyst observes repeated TCP SYN packets to various ports on a target IP with no SYN-ACK responses. What type of scan is most likely being performed?

Accepted Answer

SYN scan. A SYN scan sends SYN packets and observes responses; incomplete handshakes indicate scanning.

Answer

UDP scan

Answer

Ping sweep

Answer

TCP connect scan

Question 3

An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?

Accepted Answer

SQL injection. The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

Answer

Command injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 4

During alert triage, an analyst determines that an alert was triggered by legitimate administrative activity. How should this alert be classified?

Accepted Answer

False positive. A false positive is when an alert is triggered but no actual attack occurred.

Answer

True negative

Answer

False negative

Answer

True positive

Question 5

An analyst notices periodic HTTP GET requests to a suspicious domain every 60 seconds. The payload size is small and consistent. This behavior is characteristic of which phase of the Cyber Kill Chain?

Accepted Answer

Command and Control. Beaconing is a C2 communication technique where infected hosts periodically contact the command server.

Answer

Actions on Objectives

Answer

Delivery

Answer

Installation

Question 6

In network forensics, which Wireshark filter would be used to reconstruct a TCP conversation between two hosts?

Accepted Answer

tcp.stream eq 0. The tcp.stream filter isolates all packets belonging to a specific TCP connection.

Answer

ip.addr

Answer

http.request

Answer

dns.qry.name

Question 7

An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:

Accepted Answer

Pass-the-hash. Pass-the-hash allows an attacker to authenticate using the hash of a password without knowing the actual password.

Answer

Password spraying

Answer

Brute force

Answer

Kerberos ticket reuse

Question 8

Which of the following is a common indicator of DNS tunneling used for exfiltration?

Accepted Answer

DNS queries with long subdomain strings. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Answer

Frequent DNS queries to known domains

Answer

DNS responses with large payloads

Answer

DNS queries using TCP instead of UDP

Question 9

An analyst analyzing a PCAP sees a series of TCP connections where the client sends data with interactive patterns and receives commands. This is most likely indicative of:

Accepted Answer

Reverse shell. A reverse shell provides an interactive command-line session from the victim to the attacker.

Answer

Web browsing

Answer

File transfer

Answer

DNS query

Question 10

In the MITRE ATT&CK framework, TTPs are mapped to:

Accepted Answer

Real-world threat groups. MITRE ATT&CK maps adversary tactics, techniques, and procedures to real-world threat groups.

Answer

Vulnerability databases

Answer

Compliance standards

Answer

Network protocols

Question 11

An analyst observes a large outbound FTP transfer to an external IP address from a server that normally does not generate such traffic. This is most likely an indicator of:

Accepted Answer

Exfiltration. Data exfiltration often involves large transfers to external destinations not typical for the host.

Answer

Persistence

Answer

Lateral movement

Answer

C2 communication

Question 12

Which tool can be used to extract files from a PCAP file for further analysis?

Accepted Answer

Wireshark (Export Objects). Wireshark's 'Export Objects' feature allows you to extract files (e.g., HTTP objects, SMB files, or other application-layer payloads) from a PCAP file. This is essential for further analysis of malware or data exfiltration, as it reconstructs the original files from the captured network streams without needing to replay the traffic.

Answer

Snort

Answer

tcpdump

Answer

nmap

Question 13

An analyst is investigating a potential malware infection. Which TWO of the following are indicators of command and control (C2) communication?

Accepted Answer

DNS queries with long, random subdomains. Beaconing at regular intervals and DNS queries with encoded subdomains are classic C2 indicators.

Answer

Large file transfers to a peer host

Answer

SYN scans to multiple hosts

Answer

Regular HTTP requests to a known update server

Question 14

During an incident response, an analyst finds evidence of lateral movement. Which THREE of the following are common techniques used for lateral movement?

Accepted Answer

Remote Desktop Protocol (RDP) connections. SMB authentication attempts, pass-the-hash, and RDP are common lateral movement techniques.

Answer

DNS tunneling

Answer

ICMP echo requests

Question 15

Which TWO of the following are valid classifications for alerts during triage?

Accepted Answer

True positive. True positive and false positive are standard alert classifications.

Answer

Indeterminate

Answer

True negative

Answer

False negative