200-201 Network Intrusion Analysis Practice Test 6 — 15 Questions

Question 1

During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?

Accepted Answer

The scan sends SYN packets and, upon receiving SYN-ACK, sends RST packets.. A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.

Answer

The scan sends SYN packets and expects ICMP unreachable messages for open ports.

Answer

The scan sends SYN packets and waits for a timeout on closed ports.

Answer

The scan sends SYN packets and completes the three-way handshake for open ports.

Question 2

An analyst is investigating a potential DNS tunneling attack. Which characteristic in DNS traffic would most likely indicate DNS tunneling?

Accepted Answer

DNS queries with long, random-looking subdomains to a single domain.. DNS tunneling often encodes data in subdomains, resulting in long, random-looking domain names that differ from legitimate traffic.

Answer

Frequent DNS queries to the same domain at regular intervals.

Answer

DNS queries for domains that are known to be malicious.

Answer

DNS query responses with unusually large payload sizes.

Question 3

In the Cyber Kill Chain model, which phase involves delivering the exploit to the target, such as via email attachment or malicious link?

Accepted Answer

Delivery. The delivery phase is where the weaponized payload is transmitted to the victim, e.g., via phishing email or drive-by download.

Answer

Installation

Answer

Exploitation

Answer

Weaponization

Question 4

An analyst is reviewing a PCAP and sees multiple HTTP requests with the parameter 'id=1 UNION SELECT username,password FROM users'. What type of attack is being attempted?

Accepted Answer

SQL injection. The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.

Answer

Directory traversal

Answer

Cross-site scripting (XSS)

Answer

Command injection

Question 5

During a network intrusion investigation, an analyst notices repeated SMB authentication attempts from a single host to multiple other hosts using different usernames. Which type of activity does this pattern suggest?

Accepted Answer

Lateral movement. Lateral movement via SMB involves authenticating to multiple hosts, often with different credentials, to move across the network.

Answer

Pass-the-hash attack

Answer

SMB relay attack

Answer

Brute-force attack on SMB

Question 6

An analyst is monitoring network traffic and observes a host making outbound HTTPS connections to a domain that appears to be generated by a Domain Generation Algorithm (DGA). Which phase of the Cyber Kill Chain best describes this activity?

Accepted Answer

Command and Control (C2). After installation, the malware contacts C2 servers to receive commands. DGA domains are used for C2 communication.

Answer

Installation

Answer

Actions on Objectives

Answer

Exploitation

Question 7

An analyst is investigating a PCAP file and wants to reconstruct a conversation between two hosts. Which Wireshark filter would be most appropriate to follow the entire TCP stream?

Accepted Answer

tcp.stream eq 0. The 'tcp.stream' filter allows the analyst to follow and reconstruct the full TCP conversation.

Answer

dns.qry.name

Answer

ip.addr == 10.0.0.1

Answer

http.request

Question 8

During an incident response, an analyst identifies a PCAP containing an HTTP POST request to a suspicious external IP with a large payload. The response is not typical for web applications. What type of activity is most likely occurring?

Accepted Answer

Data exfiltration. Large outbound data transfers via HTTP POST to external IPs are indicative of data exfiltration.

Answer

SQL injection attack

Answer

Normal web browsing

Answer

Command and control beaconing

Question 9

An analyst reviews an alert that triggered on a network signature for 'shellcode' in a payload. The payload contains a sequence of NOP sleds followed by executable code. Which type of exploitation technique does this indicate?

Accepted Answer

Buffer overflow with NOP sled. A NOP sled is used to increase the chance of landing in the shellcode, commonly used in buffer overflow exploits.

Answer

Return-oriented programming (ROP)

Answer

Heap spray

Answer

Format string attack

Question 10

An analyst is analyzing a PCAP and sees multiple ICMP port unreachable responses from a target host when scanning UDP ports. What does this indicate about the scanned ports?

Accepted Answer

The ports are closed.. When a UDP scan sends a packet to a closed port, the target responds with an ICMP port unreachable message.

Answer

The scan is a SYN scan.

Answer

The ports are filtered by a firewall.

Answer

The ports are open.

Question 11

An analyst is investigating a host that is making outbound HTTPS connections to multiple random-looking domains, each with a short TTL. The domains are not in any threat intelligence feeds. Which technique is most likely being used?

Accepted Answer

Domain Generation Algorithm (DGA). Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. Short TTLs allow fast changes.

Answer

Beaconing

Answer

DNS tunneling

Answer

Fast flux DNS

Question 12

An analyst identifies a PCAP with a reverse shell session. Which characteristic in the traffic would most likely indicate an interactive shell session?

Accepted Answer

Bidirectional traffic with small packets and command echo patterns. Reverse shells often exhibit bidirectional traffic with interactive patterns, such as small irregular packets and commands echoed.

Answer

Large file transfers over FTP

Answer

Periodic HTTP GET requests at regular intervals

Answer

Constant stream of UDP packets

Question 13

An analyst is triaging alerts and encounters a scenario where an IDS alerted on a network scan, but further investigation reveals the traffic was from a legitimate vulnerability scanner. Which TWO terms best describe this alert?

Accepted Answer

Benign trigger. The alert triggered but there is no actual attack (false positive). Since the scanner is legitimate, it is not malicious.

Answer

True negative

Answer

False negative

Answer

True positive

Question 14

An analyst observes a host making outbound connections to a server on TCP port 443, with traffic patterns showing small packets at regular 60-second intervals. The destination IP is in a country where the company does no business. Which THREE characteristics suggest this is C2 beaconing?

Accepted Answer

Small packet sizes at regular 60-second intervals. Beaconing often uses HTTPS to evade detection, has periodic regular intervals, and goes to unusual destinations. Small packets at fixed intervals are classic.

Answer

Large file downloads

Answer

DNS queries for internal domains

Question 15

An analyst is examining a PCAP for signs of pass-the-hash attack. Which THREE indicators would be consistent with pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from the same host to many targets. Pass-the-hash uses NTLM authentication with a hash, often over SMB, and may show successful authentication without password.

Answer

Large DNS queries

Answer

Kerberos ticket requests