200-201 Network Intrusion Analysis Practice Test 7 — 15 Questions

Question 1

Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?

Accepted Answer

tcp.stream. The `tcp.stream` filter in Wireshark isolates a single TCP conversation by its stream index, allowing analysts to follow the entire bidirectional flow of that session. Once filtered, you can right-click and select Follow > TCP Stream to extract the full payload. This is the standard method for reconstructing application-layer data from a specific conversation in a PCAP.

Answer

tcp.port

Answer

http.request

Answer

ip.addr

Question 2

A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:

Accepted Answer

DNS tunnelling for exfiltration. DNS tunnelling for exfiltration encodes stolen data into DNS query names (often base64) and sends it to an attacker-controlled authoritative DNS server. The pattern of many subdomains with encoded-looking labels under the same domain is a classic indicator of data being smuggled out via DNS, which is frequently allowed through firewalls.

Answer

Port scan via DNS

Answer

Normal DNS resolution

Answer

DGA-based C2

Question 3

In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?

Accepted Answer

Reverse shell payload. A reverse shell payload is the correct answer because it establishes an interactive shell session where the target machine connects back to the attacker's machine, allowing the attacker to execute commands. In a PCAP, this appears as a TCP session with irregular command prompts and responses, often with small packet sizes and interactive timing. The traffic may not follow standard protocol patterns, and the commands/responses are human-readable or encoded.

Answer

File transfer tool

Answer

Port scanner

Answer

SQL injection tool

Question 4

An alert shows a high volume of outbound traffic from an internal host to an external IP using FTP. The data includes files with names matching internal document names. This activity is most likely:

Accepted Answer

Data exfiltration. The scenario describes an internal host sending a high volume of outbound FTP traffic to an external IP, with file names matching internal document names. This pattern is characteristic of data exfiltration, where an attacker steals sensitive data by transferring it to an external command-and-control (C2) or staging server. FTP is commonly used because it is a standard protocol that may not be blocked, and the file names indicate the data is likely proprietary or confidential. The volume and direction (outbound) further support exfiltration rather than normal backup or scanning.

Answer

C2 beaconing

Answer

Normal backup operation

Answer

Port scanning

Question 5

During the Cyber Kill Chain, which phase involves sending a malicious attachment to a target user via email?

Accepted Answer

Delivery. Delivery is the phase where the attacker transmits the weaponized payload to the target, such as via email attachments.

Answer

Exploitation

Answer

Weaponization

Answer

Reconnaissance

Question 6

An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?

Accepted Answer

SQL injection. The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.

Answer

Command injection

Answer

Cross-site scripting

Answer

Directory traversal

Question 7

An analyst notices periodic HTTP GET requests to a suspicious domain every 60 seconds. The payload size is small and consistent. This behavior is characteristic of which phase of the Cyber Kill Chain?

Accepted Answer

Command and Control. Periodic, small, consistent HTTP GET requests to a suspicious external domain are the hallmark of beaconing, which occurs during the Command and Control (C2) phase of the Cyber Kill Chain. The compromised host is checking in with its C2 server at regular intervals to receive instructions or exfiltrate small amounts of data. This regular, low-volume traffic pattern is designed to blend in with normal traffic while maintaining persistent control.

Answer

Actions on Objectives

Answer

Delivery

Answer

Installation

Question 8

In network forensics, which Wireshark filter would be used to reconstruct a TCP conversation between two hosts?

Accepted Answer

tcp.stream eq 0. The filter `tcp.stream eq 0` isolates all packets belonging to a specific TCP stream, identified by Wireshark's internal stream index. This allows you to reconstruct the full conversation between two hosts, including the three-way handshake, data transfer, and teardown. It is the standard method for following a TCP stream in Wireshark, as it groups packets by connection rather than just IP addresses or ports.

Answer

ip.addr

Answer

http.request

Answer

dns.qry.name

Question 9

An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:

Accepted Answer

Pass-the-hash. Pass-the-hash is the technique where an attacker uses a captured NTLM password hash directly to authenticate without knowing the plaintext password. Because NTLM authentication accepts the hash as the credential, the attacker can replay it to access systems.

Answer

Password spraying

Answer

Brute force

Answer

Kerberos ticket reuse

Question 10

Which of the following is a common indicator of DNS tunneling used for exfiltration?

Accepted Answer

DNS queries with long subdomain strings. DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.

Answer

Frequent DNS queries to known domains

Answer

DNS responses with large payloads

Answer

DNS queries using TCP instead of UDP

Question 11

In the MITRE ATT&CK framework, TTPs are mapped to:

Accepted Answer

Real-world threat groups. MITRE ATT&CK maps Tactics, Techniques, and Procedures (TTPs) to specific real-world threat groups (also called Advanced Persistent Threats or APTs). Each technique page in ATT&CK lists the known threat actors that have been observed using it, allowing defenders to attribute behaviors and prioritize defenses against groups targeting their industry. This threat-group-centric mapping is what distinguishes ATT&CK from a pure technique catalog.

Answer

Vulnerability databases

Answer

Compliance standards

Answer

Network protocols

Question 12

An analyst observes a large outbound FTP transfer to an external IP address from a server that normally does not generate such traffic. This is most likely an indicator of:

Accepted Answer

Exfiltration. A large outbound FTP transfer to an external IP from a server that normally does not generate such traffic is a classic indicator of data exfiltration — data is being stolen and sent out of the network. The volume, direction (outbound), and anomaly relative to baseline behavior all point to exfiltration rather than other attack phases.

Answer

Persistence

Answer

Lateral movement

Answer

C2 communication

Question 13

Which tool can be used to extract files from a PCAP file for further analysis?

Accepted Answer

Wireshark (Export Objects). Wireshark's 'Export Objects' feature allows you to extract files (e.g., HTTP objects, SMB files, or other application-layer payloads) from a PCAP file. This is essential for further analysis of malware or data exfiltration, as it reconstructs the original files from the captured network streams without needing to replay the traffic.

Answer

Snort

Answer

tcpdump

Answer

nmap

Question 14

An analyst is investigating a potential malware infection. Which TWO of the following are indicators of command and control (C2) communication?

Accepted Answer

DNS queries with long, random subdomains. Option D is correct because DNS queries with long, random subdomains are a classic sign of DNS tunneling or domain generation algorithm (DGA) activity used by malware to reach C2 infrastructure while evading domain reputation filtering. Option E is correct because periodic beaconing to an unusual domain reflects the regular check-in pattern malware uses to receive commands from its C2 server, often at fixed intervals with jitter. Option A is not specific to C2, as large file transfers to a peer host more commonly indicate data exfiltration or normal file sharing rather than command-and-control traffic. Option B is not specific to C2 either, since SYN scans to multiple hosts indicate reconnaissance or port scanning activity, not an established C2 channel. Option C is not an indicator of C2 because regular HTTP requests to a known update server are typical of legitimate software update behavior.

Answer

Large file transfers to a peer host

Answer

SYN scans to multiple hosts

Answer

Regular HTTP requests to a known update server

Question 15

During an incident response, an analyst finds evidence of lateral movement. Which THREE of the following are common techniques used for lateral movement?

Accepted Answer

Remote Desktop Protocol (RDP) connections. SMB authentication attempts, pass-the-hash, and RDP are common lateral movement techniques.

Answer

DNS tunneling

Answer

ICMP echo requests