200-201 Network Intrusion Analysis Practice Test 3 — 15 Questions

Question 1

A network administrator configures an IPS to drop packets that match a signature for SQL injection. However, legitimate web traffic is being blocked. What is the most likely cause?

Accepted Answer

Signature false positive. Option C is correct because a false positive occurs when the IPS incorrectly identifies legitimate traffic as malicious based on its signature. In this case, the SQL injection signature is matching benign web requests that contain patterns resembling SQL syntax (e.g., 'SELECT', 'DROP'), causing the IPS to drop valid packets. This is a common issue with signature-based detection systems that lack contextual analysis.

Answer

IPS hardware failure

Answer

Network congestion

Answer

Signature false negative

Question 2

During incident response, a security analyst reviews a PCAP file and sees TCP packets with only the SYN flag set, followed by RST packets upon receiving a SYN-ACK. No connection is established. Which scanning technique is being used?

Accepted Answer

Half-open scan (SYN scan). The described behavior—sending a SYN packet, receiving a SYN-ACK, and immediately replying with an RST—is the hallmark of a half-open (SYN) scan. This technique never completes the three-way handshake, so the target does not log an established connection, making it stealthier than a full connect scan. The RST sent after the SYN-ACK terminates the handshake before it can be fully established, confirming the port is open without creating a full session.

Answer

FIN scan

Answer

Christmas tree scan

Answer

Full connect scan

Question 3

An analyst is examining a syslog message from a Cisco ASA showing: %ASA-4-106023: Deny udp src outside:192.0.2.1/123 dst inside:10.0.0.5/123. Which type of traffic is being denied?

Accepted Answer

NTP traffic. The syslog message %ASA-4-106023 shows a UDP deny from source 192.0.2.1 port 123 to destination 10.0.0.5 port 123. Port 123 is the well-known port for Network Time Protocol (NTP), which is used for clock synchronization. Therefore, the denied traffic is NTP traffic.

Answer

HTTP traffic

Answer

SNMP traffic

Answer

DNS traffic

Question 4

What does this firewall log entry indicate?

Accepted Answer

Inbound HTTP connection denied. The firewall log entry shows a packet with source IP 10.0.0.2 (internal) and destination IP 203.0.113.5 (external) on destination port 80 (HTTP). The action is 'DENY' and the direction is 'inbound', meaning the firewall denied an incoming connection attempt from the external host to the internal host. Since the destination port is HTTP, this is an inbound HTTP connection that was denied.

Answer

Outbound HTTP connection denied

Answer

Inbound HTTP connection allowed

Answer

Outbound HTTP connection allowed

Question 5

Which type of attack does this Snort rule detect?

Accepted Answer

SQL injection. Option C is correct because the Snort rule detects SQL injection by matching the pattern 'union select' in the HTTP request body. SQL injection attacks manipulate database queries by injecting malicious SQL statements, and the rule's content match for 'union select' is a classic indicator of a UNION-based SQL injection attempt.

Answer

Cross-site scripting

Answer

Buffer overflow

Answer

Directory traversal

Question 6

Which two are common techniques used in network intrusion analysis? (Choose two.)

Accepted Answer

Signature-based detection. Signature-based detection (C) is a core technique in network intrusion analysis where predefined patterns (signatures) of known attacks—such as specific byte sequences in a packet payload or known malicious IP addresses—are matched against network traffic. This method is highly effective for detecting known threats with low false-positive rates, as it relies on exact pattern matching rather than behavioral baselines.

Answer

Threat intelligence feeds

Answer

Sandboxing

Answer

Heuristic analysis

Question 7

Which three types of data are commonly collected and analyzed for network intrusion detection? (Choose three.)

Accepted Answer

Syslog messages. Syslog messages are a standard protocol (RFC 5424) used to forward log messages from network devices, servers, and applications to a central logging server. In intrusion detection, syslog data provides critical event information such as authentication failures, interface status changes, and security policy violations, which analysts correlate with other data sources to identify malicious activity.

Answer

Windows event logs

Answer

DNS query logs

Question 8

An analyst is investigating a potential data exfiltration. Which two indicators in network traffic are most indicative of data exfiltration over DNS? (Choose two.)

Accepted Answer

Large DNS response packets. Large DNS response packets (Option B) are indicative of data exfiltration because attackers often encode stolen data into DNS TXT or other record types, causing response sizes to exceed the typical 512-byte limit and triggering EDNS0 extensions. This anomaly stands out against normal DNS traffic, where most responses are small.

Answer

Use of standard DNS ports

Answer

DNSSEC enabled

Answer

Frequent DNS query retransmissions

Question 9

Which type of attack does this Snort alert most likely indicate?

Accepted Answer

Directory traversal. The Snort alert signature 'ET WEB_SERVER ATTACKS Directory Traversal Attempt' specifically detects patterns like '../' or encoded variants (e.g., '%2e%2e%2f') in HTTP requests. This indicates an attempt to access files outside the web root directory, which is the hallmark of a directory traversal attack. The alert triggers on the URI path, not on SQL syntax or script injection patterns.

Answer

Buffer overflow

Answer

SQL injection

Answer

Cross-site scripting

Question 10

A NetFlow analysis shows a single internal host communicating with many external IP addresses on port 443, but the traffic volumes are very low (small packets). What is the most likely explanation?

Accepted Answer

C2 communication. The combination of a single internal host communicating with many external IPs on port 443 (HTTPS) with very low traffic volumes and small packets is a classic indicator of command-and-control (C2) beaconing. C2 malware often uses HTTPS to blend in with legitimate web traffic, but the small, periodic packets (e.g., keep-alive or heartbeat messages) distinguish it from normal web browsing, which would involve larger data transfers and consistent payload sizes.

Answer

Phishing

Answer

Web browsing

Answer

Port scanning

Question 11

An analyst reviews IDS alerts and sees multiple alerts for the same signature from different internal IPs targeting the same external server. One common cause is...

Accepted Answer

A worm spreading internally. A worm spreading internally (option C) is the most likely cause because worms self-replicate and propagate across a network, generating identical IDS alerts from multiple internal IPs as each infected host attempts to connect to the same external server (e.g., for command-and-control or payload delivery). This pattern—same signature, multiple internal sources, single external target—is a classic indicator of worm activity, where the worm's propagation logic causes each compromised host to initiate similar outbound connections.

Answer

A false positive

Answer

A DDoS attack

Answer

A misconfigured server

Question 12

During a security incident, an analyst uses Wireshark to examine a pcap. The TCP stream shows the string 'GET /malware.exe HTTP/1.1'. Which is the most likely type of attack?

Accepted Answer

Trojan download. The TCP stream shows an HTTP GET request for a file named 'malware.exe', which indicates the client is downloading an executable from a server. This is characteristic of a Trojan download attack, where a user is tricked into downloading and executing malicious software, often disguised as a legitimate file. The use of Wireshark to capture the HTTP request confirms the network-level activity of a file transfer, aligning with the Trojan's delivery mechanism.

Answer

Cross-site scripting

Answer

Directory traversal

Answer

SQL injection

Question 13

A security team implements an IPS that uses behavioral profiling. Which type of detection method is being used?

Accepted Answer

Anomaly-based. Behavioral profiling establishes a baseline of normal network traffic patterns and then flags deviations from that baseline as potential threats. This is the core mechanism of anomaly-based detection, which identifies malicious activity by comparing observed behavior against a learned model of normal behavior rather than against predefined signatures or rules.

Answer

Heuristic

Answer

Signature-based

Answer

Rule-based

Question 14

A network administrator wants to detect SQL injection attacks against web servers. Which type of IDS/IPS sensor placement would be most effective?

Accepted Answer

Inside the firewall on the DMZ. Option D is correct because placing the IDS/IPS inside the firewall on the DMZ allows it to inspect traffic that has already passed the firewall's initial access controls but is still destined for the web servers. SQL injection attacks target application-layer vulnerabilities in web services, and the DMZ is the network segment where these servers reside. This placement ensures the sensor can analyze decrypted HTTP/HTTPS payloads for malicious SQL patterns without being overwhelmed by general internet noise, while the firewall provides a first line of defense against non-web threats.

Answer

Outside the firewall

Answer

At the core switch

Answer

On the internal network

Question 15

A security analyst analyzes an IDS alert that triggered on the string '/etc/passwd'. What type of signature is this?

Accepted Answer

Atomic signature. The string '/etc/passwd' is a single, fixed pattern that the IDS matches against a single packet payload. This is the definition of an atomic signature: it looks for a specific content string without requiring any state or context from previous packets. Option C is correct because the alert is triggered solely by the presence of that literal string in a packet, not by any sequence of events or statistical deviation.

Answer

Stateful signature

Answer

Composite signature

Answer

Anomaly signature