200-201 Network Intrusion Analysis Practice Test 9 — 15 Questions

Question 1

A network analyst is investigating a suspected DNS tunneling attack. Which THREE of the following are indicators of DNS tunneling?

Accepted Answer

Unusually high volume of DNS queries to a single domain. DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.

Answer

DNS queries for well-known domains like google.com

Answer

Low volume of DNS queries from internal hosts

Question 2

An analyst is examining a PCAP file for signs of lateral movement. Which TWO of the following are typical indicators of lateral movement using pass-the-hash?

Accepted Answer

Multiple SMB authentication attempts from a single host to multiple other hosts. Option A is correct because pass-the-hash lateral movement typically manifests as a single compromised host authenticating over SMB (TCP 445) to numerous other hosts in rapid succession, as the attacker reuses the stolen hash to pivot across the network. Option E is correct because the defining characteristic of pass-the-hash is that NTLM authentication succeeds using only the captured NTLM hash (via tools like Mimikatz or Impacket's psexec/smbexec) without ever knowing or supplying the plaintext password. Option B is not a pass-the-hash indicator, since HTTP requests to a web server reflect normal web traffic rather than NTLM-based host-to-host authentication. Option C is unrelated, as ICMP timestamp requests are diagnostic network probes and not part of the NTLM/SMB authentication process. Option D is also unrelated, because FTP file transfers use a separate cleartext protocol and do not demonstrate hash-based credential reuse.

Answer

HTTP requests to a web server

Answer

ICMP timestamp requests

Answer

Large file transfers using FTP

Question 3

During PCAP analysis, a security analyst observes the following pattern: a series of TCP SYN packets to multiple ports on a target, followed by RST packets from the target for closed ports. Which TWO characteristics describe this scan?

Accepted Answer

It is a SYN scan. The SYN scan sends SYN packets and listens for SYN-ACK (open) or RST (closed). It is a stealthy scan because it doesn't complete the TCP handshake.

Answer

It uses ICMP echo requests

Answer

It is a UDP scan

Answer

It completes the TCP three-way handshake

Question 4

An analyst examines a PCAP and observes that an internal host sends an ICMP echo request containing a payload of 1200 bytes, followed by an ICMP echo reply from an external host with a payload of 1500 bytes. The payload data does not match standard ping patterns and appears to contain encoded file fragments. Which technique is most consistent with this observation?

Accepted Answer

ICMP tunneling for data exfiltration. Oversized ICMP echo packets carrying encoded, non-standard payloads in both directions strongly indicate ICMP tunneling, a common method for covert data transfer and exfiltration. Because many networks permit ping for troubleshooting, attackers abuse it to move data past controls that do not inspect ICMP payloads. The other options describe different ICMP-based behaviors that do not involve encoded data in echo payloads.

Answer

Smurf attack amplification

Answer

Path MTU discovery using oversized ICMP

Answer

ICMP redirect manipulation

Question 5

A SOC analyst is reviewing a PCAP captured at the network perimeter. The analyst notices that a single internal host sends a series of ICMP echo requests to multiple external hosts, but the ICMP payload size is unusually large (over 1000 bytes) and the payload contains non-ASCII, high-entropy data. The echo replies from the external hosts are also large and contain similar data. Which type of activity is most likely occurring?

Accepted Answer

ICMP tunneling. The correct answer is ICMP tunneling because the traffic pattern shows large, high-entropy payloads in both ICMP echo requests and replies, which is a known method for covert data exfiltration or command-and-control. Normal ICMP traffic uses small, predictable payloads. The other options describe denial-of-service or routing manipulation attacks that do not match the observed bidirectional data exchange.

Answer

ICMP redirect attack

Answer

Ping flood

Answer

Smurf attack

Question 6

An analyst is examining a PCAP and sees a series of TCP packets where the client sends a SYN, receives a SYN-ACK, and then sends an ACK. Immediately after, the client sends a packet with the RST flag set, terminating the connection before any application data is exchanged. This pattern repeats across many destination ports on the same server. Which activity does this most likely represent?

Accepted Answer

TCP connect scan. The full three-way handshake followed by an immediate RST indicates a TCP connect scan. This scan type uses the operating system's connect() function to establish a complete TCP connection, then resets it. It is less stealthy than a SYN scan because it generates more logs on the target, but it works without raw socket privileges.

Answer

TCP SYN scan

Answer

TCP ACK scan

Answer

TCP FIN scan

Question 7

A SOC analyst is analyzing a PCAP from a suspected intrusion. The traffic shows a series of TCP connections where the client sends a SYN, receives a SYN-ACK, then immediately sends a RST instead of an ACK, and this pattern repeats across multiple ports on the same target. Which type of scan is most likely being performed?

Accepted Answer

TCP SYN stealth scan. The pattern of SYN, SYN-ACK, then RST indicates a half-open TCP scan, commonly known as a SYN stealth scan. The attacker sends a SYN, receives a SYN-ACK if the port is open, but resets the connection instead of completing the handshake. This avoids establishing a full connection and is often used to evade detection while enumerating open ports.

Answer

UDP scan

Answer

TCP connect scan

Answer

TCP FIN scan

Question 8

A SOC analyst reviewing a packet capture notices that a single internal host has initiated hundreds of short-lived TCP sessions to the same external web server over the past hour, and every session completed a full three-way handshake before being torn down with FIN/ACK. No single session transferred more than a few kilobytes. Which traffic characteristic should the analyst use to classify this activity?

Accepted Answer

Possible beaconing or automated application behavior, because repeated uniform short sessions at regular volume suggest periodic callbacks.. Repeated short TCP sessions with complete handshakes and consistent small payloads point to periodic automated communication such as malware beaconing, not resource-exhaustion attacks or scanning. A SYN flood and slowloris both leave connections incomplete by design, while a port scan varies destination ports and usually never completes a session. The distinguishing evidence is the uniform, repeating, fully established flow pattern.

Answer

A TCP SYN flood, because many connection attempts were made to one destination in a short period.

Answer

A slowloris-style denial of service, because each session stayed open for a short time.

Answer

A port scan, because the host contacted the same server repeatedly.

Question 9

A SOC analyst is reviewing a PCAP captured at the perimeter firewall. The analyst notices that a single internal host has sent TCP segments with the FIN, PSH, and URG flags all set simultaneously to multiple destination ports on several external hosts. No corresponding ACK, SYN, or RST packets are observed in the capture. Which type of scan is the analyst most likely observing?

Accepted Answer

TCP Xmas scan. The combination of FIN, PSH, and URG flags in a single TCP segment is the defining signature of a TCP Xmas scan. Because RFC 793 requires closed ports to respond with RST to any segment not containing SYN, and open ports to ignore such segments, attackers use this flag combination to enumerate ports without establishing a full connection and with minimal logging on the target host.

Answer

TCP NULL scan

Answer

TCP ACK scan

Answer

TCP SYN stealth scan

Question 10

A security analyst notices that an internal web server is receiving HTTP requests where the User-Agent string is identical across thousands of requests originating from a single external IP address, and each request targets a different URL path on the server. The requests occur at a rate of several hundred per second. Which activity does this pattern most likely represent?

Accepted Answer

Automated directory brute-forcing or content discovery. The pattern of one external IP sending hundreds of requests per second to many different URL paths with a constant User-Agent is a classic signature of automated content discovery and directory brute-forcing. These tools enumerate paths to uncover hidden resources. Legitimate crawlers rate-limit and identify themselves, while CSRF and response splitting involve different traffic characteristics.

Answer

Web content scraping by a search engine crawler

Answer

Cross-site request forgery against authenticated users

Answer

HTTP response splitting attack

Question 11

An analyst examining a PCAP sees an internal host sending ICMP echo requests where the payload length is consistently 1,100 bytes and the payload bytes change on every packet, while the destination is an external IP that returns echo replies of normal size. The host has no monitoring tool installed and no legitimate reason to send large ICMP. Which technique is most likely being used?

Accepted Answer

ICMP tunneling used to exfiltrate or relay data inside echo request payloads.. Normal ICMP echo traffic uses small, fixed payloads for reachability. Large echo requests whose payload changes on every packet indicate the ICMP payload is being used as a transport for data, a covert channel known as ICMP tunneling. The external endpoint returning ordinary replies supports a request-carries-data-out model. Flood, MTU discovery, and smurf do not produce varying large payloads from a single internal host.

Answer

A ping flood denial-of-service attack against the external host.

Answer

Path MTU discovery using oversized ICMP packets to find fragmentation limits.

Answer

A smurf attack reflecting ICMP echo requests off the external host to a broadcast address.

Question 12

An analyst is investigating a suspected TCP session hijacking attempt. The analyst reviews a PCAP and sees duplicate packets with the same sequence numbers but different source IP addresses. Which two TCP characteristics would most likely be manipulated in such an attack? (Choose two.)

Accepted Answer

Acknowledgement numbers. TCP session hijacking requires the attacker to inject packets that appear to be from the legitimate client. To do this, the attacker must know or predict the current sequence numbers and provide valid acknowledgement numbers. Manipulating these two fields allows the attacker to insert data into the stream without the server rejecting it. Other TCP fields like window size or urgent pointer are not central to this attack.

Answer

Urgent pointer

Answer

Window size

Answer

Maximum segment size (MSS)

Question 13

An analyst is examining a PCAP of what appears to be a covert channel. The analyst observes that the internal host sends ICMP Echo Requests that contain a payload of exactly 48 bytes of non-repeating binary data, and the corresponding Echo Replies always return with a zero-length payload. The payload bytes, when decoded, contain what looks like command strings. Which technique is most consistent with these observations?

Accepted Answer

ICMP tunneling using Echo Request payloads as a data exfiltration and command channel. The defining indicators of ICMP tunneling are Echo Request or Echo Reply packets carrying non-standard, often non-repeating or encoded payloads, especially when those payloads contain structured data such as command strings. Normal ping traffic uses predictable, often repeating payloads like alphabetic patterns. The one-way data flow with empty replies here strongly suggests the channel is being used to deliver commands or exfiltrate data covertly.

Answer

ICMP redirect attack manipulating the host's routing table

Answer

ICMP flood denial-of-service attack against the external host

Answer

Smurf attack using the internal host as an unwitting reflector

Question 14

A SOC analyst notices an internal host transmitting a series of ICMP Echo Request packets to an external IP, each with a payload size of exactly 1024 bytes and a repeating pattern. The echo replies are consistently the same size. Which type of activity does this most likely indicate?

Accepted Answer

ICMP tunneling. The correct answer is ICMP tunneling because the traffic shows large, fixed-size ICMP payloads with repeating patterns and matching replies, which are hallmarks of data being hidden inside ICMP Echo packets. Normal ICMP usage involves small, variable payloads for diagnostics, not consistent large payloads, indicating a covert channel.

Answer

Legitimate network latency testing

Answer

Network reconnaissance via ping sweep

Answer

ICMP flood denial-of-service

Question 15

A junior analyst is reviewing a packet capture and sees a workstation repeatedly sending ICMPv4 Type 8 packets to an external IP address with varying payload sizes. The analyst wants to confirm whether this activity is a covert channel. Which characteristic of the ICMP traffic would most strongly suggest that the ICMP payload is being used to exfiltrate data?

Accepted Answer

The ICMP payload data changes on every request and contains non-printable, high-entropy bytes.. Covert ICMP channels hide data inside the payload of echo requests and replies. Benign pings use fixed, printable payload patterns, so a payload that changes on every packet and contains high-entropy, non-printable bytes strongly suggests encoded data is being transmitted. Combined with an external destination, this pattern points to ICMP-based exfiltration rather than routine connectivity testing.

Answer

The ICMP echo requests are sent at a fixed interval of exactly one second.

Answer

The ICMP echo requests contain a consistent sequence number and identifier.

Answer

The ICMP echo requests receive echo replies from the same external IP address.