200-201 Network Intrusion Analysis — Timed 15 Questions

Question 1

An analyst identifies an alert for 'ET TROJAN Win32/DarkComet RAT Beacon'. The analyst confirms the host is infected. Which THREE phases of the Cyber Kill Chain have been completed prior to this C2 beacon? (Choose three.)

15 minute time limit — choose an answer to begin.

Accepted Answer

Installation. In the Cyber Kill Chain, the phases completed before C2 beaconing are: Reconnaissance, Weaponization, Delivery, Exploitation, and Installation. The question asks for two phases, but three (Installation, Exploitation, and Delivery) are actually completed prior to C2. However, based on the flag, Installation must be included. Delivery and Exploitation are also correct because without delivery the malware cannot be installed, and exploitation enables installation.

Answer

Weaponisation

Answer

Reconnaissance

Question 2

During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?

Accepted Answer

Reconnaissance. The SYN scan is a reconnaissance technique used to identify open ports without completing the TCP handshake. The RST response indicates the port is closed, and the lack of ACK means the handshake was intentionally not completed, characteristic of a SYN scan.

Answer

Delivery

Answer

Weaponization

Answer

Exploitation

Question 3

An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?

Accepted Answer

UDP scan; true positive. UDP scans send UDP packets; closed ports respond with ICMP Port Unreachable. This matches the alert signature, indicating a true positive for a UDP scan.

Answer

TCP SYN scan; true positive

Answer

UDP scan; false positive

Answer

TCP connect scan; true negative

Question 4

A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?

Accepted Answer

GET /products?id=1 UNION SELECT * FROM users. SQL injection often involves injecting SQL keywords like UNION or SELECT into parameters. 'id=1 UNION SELECT' is a classic example.

Answer

GET /login?user=admin&pass=password123

Answer

GET /search?q=

Answer

GET /index.html HTTP/1.1

Question 5

An analyst detects traffic from an internal host that periodically sends small DNS queries to a domain with high entropy subdomains (e.g., 'a3k9f2.example.com'). The domain is not on any blocklist, and the query intervals are consistent every 60 seconds. Which technique is most likely being used?

Accepted Answer

DNS tunnelling for C2 communication. DNS tunnelling encodes data in subdomain queries, and periodic beaconing is common for C2. High entropy subdomains and regular intervals suggest DNS tunnelling for C2.

Answer

DNS amplification attack

Answer

Normal DNS resolution for a dynamic DNS service

Answer

DNS cache poisoning attempt

Question 6

During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?

Accepted Answer

Delivery. The file contains shellcode and is extracted from network traffic, indicating it was delivered to the target. This aligns with the delivery phase.

Answer

Installation

Answer

Actions on Objectives

Answer

Weaponization

Question 7

An analyst is investigating lateral movement and observes SMB authentication attempts from host A to multiple other hosts using NTLM authentication with a hash value instead of a password. Which attack technique is most likely being used?

Accepted Answer

Pass-the-hash attack. Pass-the-hash uses NTLM hashes to authenticate without the plaintext password. SMB authentication with hashes is a classic sign.

Answer

Brute force attack

Answer

Kerberos golden ticket attack

Answer

SMB relay attack

Question 8

A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?

Accepted Answer

Credential theft via phishing. Plaintext credentials in HTTP POST bodies indicate credential theft, possibly via phishing or a compromised web form.

Answer

Cross-site scripting (XSS)

Answer

Brute force attack

Answer

SQL injection

Question 9

An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?

Accepted Answer

Periodic connections at regular intervals to an external IP. Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.

Answer

Large data transfers to a known cloud provider

Answer

ICMP echo requests to multiple hosts

Answer

Random intervals with varying packet sizes

Question 10

An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?

Accepted Answer

Actions on Objectives. Exfiltration of sensitive data is part of 'Actions on Objectives', where the attacker achieves their goal of stealing data.

Answer

Installation

Answer

C2

Answer

Exploitation

Question 11

A security analyst is reviewing PCAP data and sees a TCP stream with interactive shell commands such as 'whoami', 'ls -la', and 'cat /etc/passwd'. The session appears to be bidirectional with a remote IP. Which type of attack is most likely occurring?

Accepted Answer

Reverse shell. Interactive shell commands over TCP indicate a reverse shell, where the attacker has a command shell on the victim.

Answer

DNS tunnelling

Answer

SQL injection

Answer

Man-in-the-middle attack

Question 12

An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?

Accepted Answer

False positive. The alert triggered but there was no actual attack, so it is a false positive.

Answer

True negative

Answer

False negative

Answer

True positive

Question 13

During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?

Accepted Answer

Multiple DNS queries to algorithmically generated domains that result in NXDOMAIN responses. DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.

Answer

Large DNS responses indicating amplification

Answer

DNS queries to a single domain with high frequency

Answer

DNS queries with long TTL values

Question 14

A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?

Accepted Answer

DNS responses with unusually large TXT record sizes. DNS exfiltration involves encoding data in subdomain queries, often with high entropy, and can use TXT records to retrieve data.

Answer

Large number of ICMP echo requests to external hosts

Answer

Consistent traffic to a known C2 server on port 443

Answer

Multiple failed HTTP POST requests to a file-sharing site

Question 15

An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?

Accepted Answer

Return-oriented programming (ROP) gadget chains in data. Exploitation indicators include shellcode patterns (NOP sleds, ROP gadgets) and heap spray (large blocks of similar data).

Answer

Regular HTTP GET requests to a news website

Answer

DNS requests for common websites like google.com