200-201 Network Intrusion Analysis Practice Test 6 — 15 Questions

Question 1

An analyst notices that a DNS query for 'www.attacker.com' contains a long subdomain with Base64-encoded data. This activity is observed every 5 minutes. What exfiltration technique is most likely in use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, often using Base64 or hex in subdomains, and is characterized by periodic, high-volume queries to a single domain. The long Base64-encoded subdomain and 5-minute interval are classic indicators of data exfiltration via DNS. Attackers use this because DNS is rarely blocked and often overlooked by security controls.

Answer

Steganography

Answer

HTTP POST exfiltration

Answer

FTP exfiltration

Question 2

In a PCAP, an analyst sees a large outbound data transfer over FTP to an external IP address during non-business hours. The source host is a database server. Which phase of the Cyber Kill Chain does this represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's 'Actions on Objectives' phase is where the attacker achieves their ultimate goal, such as exfiltrating data. In this scenario, a large outbound FTP transfer from a database server to an external IP during non-business hours directly indicates data theft, which is the final objective of the intrusion. FTP (port 21/20) is used here as the exfiltration protocol, moving sensitive data out of the network.

Answer

Installation

Answer

Weaponization

Answer

Exploitation

Question 3

An analyst is reviewing PCAP and sees a TCP stream with a Wireshark filter 'tcp.stream eq 0'. The conversation shows an interactive shell session with commands like 'whoami' and 'ls'. This is most likely evidence of what?

Accepted Answer

Reverse shell. The PCAP shows an interactive shell session with commands like 'whoami' and 'ls' over TCP. This is characteristic of a reverse shell, where an attacker compromises a host and establishes a command-and-control channel back to their machine, allowing interactive command execution. The use of 'tcp.stream eq 0' in Wireshark simply isolates a specific TCP conversation, and the presence of shell commands confirms a reverse shell.

Answer

DNS tunneling

Answer

SQL injection

Answer

ARP spoofing

Question 4

An analyst examines a PCAP and finds a series of UDP packets sent to multiple ports on a target. The target responds with ICMP 'Destination Unreachable (Port Unreachable)' messages for each port. What type of scan is being performed?

Accepted Answer

UDP scan. A UDP scan works by sending a UDP packet to a target port. If the port is closed, the target responds with an ICMP Port Unreachable message (Type 3, Code 3). If the port is open, the service may or may not reply, so the absence of an ICMP unreachable is interpreted as 'open|filtered.' The pattern of UDP probes followed by ICMP Port Unreachable responses is the signature of a UDP scan.

Answer

SYN scan

Answer

Xmas scan

Answer

FIN scan

Question 5

A security analyst is investigating a potential exploit. The PCAP shows a HTTP POST request containing a long string of characters that, when decoded, reveals a series of return-oriented programming (ROP) gadgets. What is the likely purpose of this payload?

Accepted Answer

Exploitation. ROP gadgets are used to bypass non-executable memory protections by chaining together small code sequences to execute arbitrary code. This is an exploitation technique.

Answer

Lateral movement

Answer

Privilege escalation

Answer

Persistence

Question 6

During a forensic analysis, an analyst uses NetworkMiner to extract files from a PCAP. One of the extracted files contains a PE executable with a known signature of a malware variant. Which phase of the Cyber Kill Chain does the file transfer most likely represent?

Accepted Answer

Delivery. The file transfer from the PCAP represents the Delivery phase because NetworkMiner extracted a PE executable that was transmitted over the network, likely via HTTP, SMTP, or SMB. In the Cyber Kill Chain, Delivery is the phase where the weaponized payload is transmitted to the target system, which is exactly what a file transfer in a PCAP captures. The presence of a known malware signature confirms the payload was delivered, not yet executed or exploited.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 7

An analyst detects HTTPS traffic to a domain that was registered only 24 hours ago and has no web content. The traffic occurs at odd hours and with consistent packet sizes. What technique is likely being used for C2?

Accepted Answer

HTTPS beaconing to a malicious domain. Attackers often use newly registered domains (DGAs or manually registered) for C2 to avoid blacklists. HTTPS provides encryption to hide the beaconing.

Answer

DNS tunneling

Answer

HTTP POST exfiltration

Answer

Domain Generation Algorithm (DGA)

Question 8

An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)

Accepted Answer

SMB relay. SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.

Answer

Kerberoasting

Answer

Brute force

Answer

Golden ticket

Question 9

During an incident, an analyst observes the following in PCAP: (1) DNS queries with random-looking subdomains to a known malicious domain, (2) large outbound FTP transfers of .zip files, (3) HTTP POST requests with Base64-encoded data in the body. Which THREE exfiltration techniques are being used? (Select 3)

Accepted Answer

FTP exfiltration. Option B (FTP exfiltration) is correct because the PCAP shows large outbound FTP transfers of .zip files, which is a classic data exfiltration pattern where stolen data is archived and sent over FTP to an external server. Option C (DNS tunneling) is correct because DNS queries with random-looking subdomains to a known malicious domain indicate data being encoded into DNS query names and sent to an attacker-controlled authoritative DNS server, a hallmark of DNS tunneling. Option E (HTTP exfiltration via POST) is correct because HTTP POST requests carrying Base64-encoded data in the body are a common method of covertly exfiltrating data through web traffic that blends in with normal HTTP. Option A (ICMP exfiltration) does not belong because no ICMP echo request/reply traffic with embedded payloads is described in the PCAP. Option D (Steganography) does not belong because steganography involves hiding data inside other files such as images or audio, and no such carrier files or hidden-content artifacts are mentioned in the observed traffic.

Answer

ICMP exfiltration

Answer

Steganography

Question 10

In the Cyber Kill Chain, which phase involves sending a malicious attachment to a targeted user?

Accepted Answer

Delivery. In the Lockheed Martin Cyber Kill Chain, Delivery is the phase where the attacker transmits the weaponised payload to the victim — for example, via a phishing email with a malicious attachment, a malicious link, or a USB drop. Sending the malicious attachment to a targeted user is the textbook definition of Delivery. Weaponization (the prior phase) is where the attacker pairs the exploit with the payload, but the actual transmission to the target is Delivery.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 11

A security analyst receives an alert for a known malware signature in an outbound file transfer. After investigation, the file is confirmed as benign software. This alert is classified as:

Accepted Answer

False positive. A false positive is an alert that fires for benign activity — the detection correctly identified a signature match, but the file was confirmed benign, so the alert is a false positive. In this scenario, the malware signature matched an outbound file transfer, but investigation confirmed the file is legitimate software, making it a false positive.

Answer

True positive

Answer

False negative

Answer

True negative

Question 12

During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?

Accepted Answer

RST. In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.

Answer

ICMP Port Unreachable

Answer

ACK

Answer

SYN-ACK

Question 13

Which type of attack is indicated by a series of SMB authentication attempts from one host to multiple other hosts in a short time frame?

Accepted Answer

Lateral movement. Lateral movement often involves propagating across hosts using SMB for remote access and authentication.

Answer

Port scanning

Answer

C2 beaconing

Answer

DNS exfiltration

Question 14

A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:

Accepted Answer

Beaconing using DGA. Periodic outbound HTTPS connections to an unusual domain that resolves to different IPs each time is the classic signature of beaconing using a Domain Generation Algorithm (DGA). Malware uses DGA to generate many pseudo-random domains and rotates through them to evade blocklists, while beaconing provides regular check-ins to C2.

Answer

Exfiltration via FTP

Answer

DNS tunnelling

Answer

Port scanning

Question 15

A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:

Accepted Answer

SQL injection. SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.

Answer

Cross-site scripting

Answer

Path traversal

Answer

Command injection