200-201 Network Intrusion Analysis Practice Test 5 — 15 Questions

Question 1

An analyst is reviewing alerts from an IDS. A signature matched 'script' and 'alert' in HTTP request parameters. The analyst inspects the packet and sees <script>alert('XSS')</script> in the URI. What is the most accurate classification of this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

True positive. The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.

Answer

False negative

Answer

False positive

Answer

True negative

Question 2

In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?

Accepted Answer

SQL injection. The filter 'http.request.uri contains "UNION"' detects HTTP requests where the URI contains the SQL keyword 'UNION'. The presence of 'SELECT' and 'UNION SELECT' in URI parameters is a classic signature of SQL injection (SQLi), where an attacker attempts to manipulate backend database queries by injecting SQL code into input fields. This attack targets the database layer, aiming to extract or modify data, and is distinct from other web vulnerabilities.

Answer

Buffer overflow

Answer

Cross-site scripting

Answer

Command injection

Question 3

An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.

Answer

Golden ticket

Answer

Kerberoasting

Answer

Pass-the-ticket

Question 4

An analyst observes a series of DNS queries for subdomains like 'ZGVzdGluYXRpb24= .malicious.com' where the subdomain part appears base64-encoded. The volume of DNS traffic from a single host is unusually high. Which exfiltration technique is most likely in use?

Accepted Answer

DNS tunnelling. The base64-encoded subdomains and high volume of DNS queries from a single host are classic indicators of DNS tunnelling, where data is exfiltrated by encoding it into DNS query names (e.g., subdomains) sent to an attacker-controlled domain. DNS is often allowed through firewalls, making it an attractive covert channel. The base64 encoding allows arbitrary binary data to be transmitted as DNS labels, and the high query volume reflects the data transfer.

Answer

FTP exfiltration

Answer

HTTP POST exfiltration

Answer

Steganography in images

Question 5

During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?

Accepted Answer

Heap spray. Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.

Answer

Return-oriented programming (ROP)

Answer

Shellcode injection

Answer

Stack buffer overflow

Question 6

A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?

Accepted Answer

False positive. A false positive occurs when a security tool raises an alert for activity that is not actually malicious or successful. Here, the SQL injection payload 'id=1 OR 1=1' was detected in the request, but the server returned a normal page with no signs of compromise, meaning the attack did not succeed and the alert was triggered on suspicious input rather than actual exploitation. Therefore, the alert is a false positive.

Answer

True negative

Answer

False negative

Answer

True positive

Question 7

A threat hunter identifies a binary that uses a Domain Generation Algorithm (DGA) to create domain names like 'eksdghf23.com', 'mzncxv89.net' each day. The malware contacts these domains over HTTPS. Which phase of the Cyber Kill Chain is most directly associated with this technique?

Accepted Answer

Command and Control. The use of a DGA to generate domain names that the malware contacts over HTTPS is the defining characteristic of the Command and Control (C2) phase. The malware is attempting to reach its operator's infrastructure to receive instructions or send data. This occurs after the malware is installed and before the attacker achieves their objectives.

Answer

Installation

Answer

Exploitation

Answer

Actions on Objectives

Question 8

An analyst reviews network logs and sees a large outbound FTP transfer of 500 MB from a workstation to an external IP at 2:00 AM. The workstation regularly sends 10 MB daily. What should the analyst suspect?

Accepted Answer

Data exfiltration. Large outbound data transfers outside normal patterns, especially at odd hours, are typical of data exfiltration.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Software update

Question 9

An analyst filters PCAP with 'tcp.stream eq 0' and sees an interactive shell session with commands like 'whoami', 'ls -la', 'cd /etc'. The session originated from an HTTP POST to a web shell. Which type of attack is this?

Accepted Answer

Reverse shell. A web shell allows remote command execution over HTTP, essentially a reverse shell.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Cross-site scripting

Question 10

An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)

Accepted Answer

ROP gadgets. Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.

Answer

NOP sled

Answer

Heap spray

Answer

DNS tunnelling

Question 11

An analyst observes an alert triggered by a single SYN packet to a closed port. The packet did not complete a TCP handshake. What type of attack does this most likely indicate?

Accepted Answer

SYN scan. A single SYN packet to a closed port that does not complete the TCP handshake is the signature of a SYN scan (half-open scan). The scanner sends SYN; if the port is closed, the target responds with RST, and the scanner never sends ACK. This is the classic behavior of tools like Nmap's -sS scan.

Answer

TCP connect scan

Answer

Ping sweep

Answer

UDP scan

Question 12

During alert triage, an analyst determines that an alert fired but no actual attack or malicious activity occurred on the network. How should this alert be classified?

Accepted Answer

False positive. A false positive occurs when an alert fires but no actual malicious activity is present. The analyst determined that no attack occurred, so the alert is a false positive. This is a common occurrence in security operations and requires tuning of detection rules to reduce noise.

Answer

True negative

Answer

False negative

Answer

True positive

Question 13

An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?

Accepted Answer

Command and Control. The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.

Answer

Delivery

Answer

Actions on Objectives

Answer

Installation

Question 14

While analyzing a PCAP, an analyst uses the Wireshark filter 'http.request' and finds a URI parameter containing '%27%20UNION%20SELECT%201,2,3%20--'. What type of attack is indicated?

Accepted Answer

SQL injection. The URL-encoded string decodes to a SQL injection attempt with UNION SELECT. SQL injection often appears in HTTP parameters.

Answer

Cross-site scripting (XSS)

Answer

Command injection

Answer

Directory traversal

Question 15

An analyst detects multiple SMB authentication attempts from a single internal host to several other internal hosts using NTLM hashes instead of plaintext passwords. Which technique is most likely being used?

Accepted Answer

Pass-the-hash. Pass-the-hash is the technique where an attacker uses a captured NTLM hash to authenticate to remote systems without knowing the plaintext password. The scenario — one internal host authenticating to many others using NTLM hashes — is the canonical lateral-movement signature of pass-the-hash, typically executed with tools like Mimikatz, CrackMapExec, or Impacket. The fan-out pattern from a single source to multiple targets is a strong indicator of automated credential reuse.

Answer

Brute force

Answer

Kerberoasting

Answer

Golden ticket attack