200-201 Network Intrusion Analysis Practice Test 4 — 15 Questions

Question 1

An analyst sees an alert with source IP 10.0.0.1 and destination IP 192.168.1.100 on port 80. The alert type is 'WEB-MISC Attempt to execute command on server'. Which action is most appropriate?

Accepted Answer

Verify if the target host is vulnerable. Option A is correct because the alert 'WEB-MISC Attempt to execute command on server' from source IP 10.0.0.1 to destination IP 192.168.1.100 on port 80 indicates a potential command injection attempt against a web server. The most appropriate first action is to verify if the target host is actually vulnerable to such an attack, as this determines whether the alert is a true positive requiring remediation or a false positive that can be dismissed. This aligns with the network intrusion analysis process of validating alerts before taking irreversible actions.

Answer

Ignore because it's a false positive

Answer

Immediately block the source IP

Answer

Escalate to law enforcement

Question 2

Which command-line tool is used to capture and analyze network packets in real time?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures and displays network packets in real time directly from the terminal. It uses libpcap to intercept raw packets at the network interface, making it ideal for scripting and remote session analysis where a GUI is unavailable.

Answer

Wireshark

Answer

Nmap

Answer

Nessus

Question 3

A network intrusion detection system (NIDS) generates an alert for a known exploit against a web server. The analyst verifies that the server is patched. What is the next best step?

Accepted Answer

Investigate if the exploit was actually attempted. Even if the server is patched, the exploit attempt may indicate a broader attack or reconnaissance. Investigating the attempt helps determine intent and identify other compromised systems.

Answer

Reconfigure the NIDS to block the traffic

Answer

Tune the signature to ignore the server

Answer

Dismiss the alert as a false positive

Question 4

During an incident, an analyst captures network traffic. Which field in a TCP header is used to reassemble fragmented packets?

Accepted Answer

Sequence number. The Sequence Number field in the TCP header is used to reassemble fragmented packets because it indicates the order of data bytes in the stream. When a TCP segment is fragmented at the IP layer, the sequence number allows the receiver to correctly reorder the fragments based on the original byte stream, ensuring proper reassembly.

Answer

Flags

Answer

Window size

Answer

Acknowledgment number

Question 5

An analyst reviews Snort alert logs and sees many alerts for 'SQL Injection Attempt' from a single external IP to a public-facing web server. Which analysis step is most effective?

Accepted Answer

Check the web server logs for the same IP. Checking the web server logs for the same IP is the most effective step because it allows the analyst to correlate the Snort alerts with actual HTTP requests. This confirms whether the SQL injection attempts were successful or merely reconnaissance, and provides context such as the specific URI, parameters, and response codes (e.g., 200 vs 500) needed to assess impact.

Answer

Block the IP at the firewall immediately

Answer

Run a port scan against the IP

Answer

Disable the SQL injection signature

Question 6

Given a packet capture showing TCP packets with flags: first packet SYN, second packet SYN-ACK, third packet ACK, then a fourth packet with RST flag. What should the analyst suspect?

Accepted Answer

Port scan. The three-way handshake (SYN, SYN-ACK, ACK) completes a TCP connection, but the immediate RST after the ACK indicates the client terminated the connection without sending any application data. This pattern is characteristic of a port scan (e.g., using nmap's connect scan), where the scanner verifies the port is open by completing the handshake and then immediately resets to avoid leaving the connection half-open.

Answer

Normal traffic

Answer

SYN flood

Answer

Denial of service

Question 7

A Snort rule is configured: alert udp $HOME_NET 123 -> $EXTERNAL_NET any (msg:'NTP DDoS'; content:'|17 00 03 2a|'; depth:4;). What does this rule detect?

Accepted Answer

NTP amplification attack. The rule triggers on UDP traffic from port 123 (NTP) on the internal network to any port on an external network, with a payload starting with the bytes `17 00 03 2a`. These bytes correspond to the NTP control message header for a `MON_GETLIST` request (opcode 0x17, sequence 0x00, status 0x03, association ID 0x002a), which is the classic pattern used in NTP amplification attacks. This detects an outgoing NTP query that attempts to exploit the `monlist` command to reflect a large volume of traffic toward a victim, making D correct.

Answer

SNMP community string

Answer

NTP server misconfiguration

Answer

DNS amplification attack

Question 8

A host inside the network has a connection to a known malicious IP with TCP state TIME_WAIT. What is the most likely interpretation?

Accepted Answer

The host has finished its communication. The TIME_WAIT TCP state indicates that the local host has initiated the closure of the connection and is waiting for any delayed packets to arrive before fully releasing the socket. This state is entered after the local host sends the final ACK in the four-way handshake, meaning the host has completed its communication with the remote IP. Therefore, the connection is finished, not ongoing.

Answer

The connection was terminated by the remote host

Answer

The host is being scanned

Answer

The host is actively infected and communicating

Question 9

Which TWO of the following are indicators of a network scan?

Accepted Answer

ICMP echo requests to multiple hosts. Option B is correct because ICMP echo requests (ping sweeps) sent to multiple hosts are a classic reconnaissance technique used to identify live hosts on a network. This type of scan maps the network topology before launching further attacks, and it is a clear indicator of network scanning activity.

Answer

Single connection to a well-known port

Answer

DNS queries for many domains

Answer

Large number of SYN packets to a single port from multiple sources

Question 10

Which TWO actions should an analyst take when a critical alert is triggered?

Accepted Answer

Verify the alert with other sources. Option B is correct because verifying a critical alert with other sources (e.g., correlating with firewall logs, NetFlow data, or endpoint detection responses) is a fundamental step to confirm the alert is a true positive and not a false positive. This cross-validation reduces the risk of acting on inaccurate information and ensures that the incident response process is based on reliable evidence. Without verification, an analyst might escalate a non-threatening event, wasting resources and potentially missing a real threat.

Answer

Delete the alert to reduce noise

Answer

Search for similar alerts in the past

Answer

Immediately power off the affected system

Question 11

Which THREE of the following are common evasion techniques used by attackers?

Accepted Answer

Slow scans. Slow scans are a common evasion technique used by attackers to avoid detection by intrusion detection systems (IDS) and intrusion prevention systems (IPS). By sending packets at a very low rate, often over hours or days, the scan falls below the threshold of time-based detection algorithms that trigger alerts on rapid port sweeps. This technique exploits the fact that many security devices rely on timing heuristics to identify reconnaissance activity.

Answer

Using high ports

Answer

Patching vulnerabilities

Question 12

Refer to the exhibit. What does this Snort rule detect?

Accepted Answer

Exploit code for a buffer overflow. The Snort rule detects a buffer overflow attempt by matching a specific pattern (e.g., a long string of 'A' characters or a shellcode pattern) in the payload, which is characteristic of exploit code targeting a vulnerable service. Buffer overflow exploits often send oversized data to trigger memory corruption, and Snort rules use content matching and byte_test to identify such anomalies. This rule likely targets a known overflow in a protocol like SMB or RPC, but the signature is specific to the exploit payload, not the protocol itself.

Answer

A NetBIOS name service query

Answer

A vulnerability in Microsoft RPC

Answer

Normal SMB traffic

Question 13

Refer to the exhibit. What does this packet capture indicate?

Accepted Answer

Port scan. The packet capture shows multiple TCP SYN packets sent to a single host (10.10.10.10) targeting different ports (80, 443, 22, 21) with no subsequent ACK or RST responses. This pattern is characteristic of a port scan, specifically a SYN scan, where the attacker sends SYN packets to probe for open ports without completing the three-way handshake.

Answer

SYN flood

Answer

Session hijack

Answer

Normal HTTP traffic

Question 14

Refer to the exhibit from a Cisco Firepower event. Which action is most appropriate for the analyst?

Accepted Answer

Investigate the source host for compromise. The exhibit shows a single intrusion event from a specific source IP to a destination IP. The most appropriate first step is to investigate the source host for compromise because the event indicates a potential exploit attempt originating from that host. Without additional context (e.g., multiple events, confirmed data exfiltration), escalating to law enforcement or blocking the IP is premature, and disabling the signature would blind the sensor to future threats.

Answer

Escalate to law enforcement

Answer

Block the destination IP

Answer

Disable the intrusion signature

Question 15

An analyst is reviewing Snort alerts and notices repeated 'ET SCAN Potential SSH Scan' alerts from the same source IP. Which action should the analyst take next?

Accepted Answer

Correlate with authentication logs to confirm unsuccessful attempts.. Option A is correct because Snort alerts for 'ET SCAN Potential SSH Scan' indicate a pattern of connection attempts to the SSH port (TCP/22), but the alert alone does not confirm whether the attempts were successful or malicious. Correlating with authentication logs (e.g., /var/log/auth.log or Windows Event ID 4625) allows the analyst to verify failed login attempts, which is the definitive evidence of an actual SSH brute-force attack. This step aligns with the network intrusion analysis methodology of validating alerts before taking action.

Answer

Run a vulnerability scan on the destination.

Answer

Ignore because it is a false positive.

Answer

Immediately block the IP on the firewall.