200-201 Network Intrusion Analysis Practice Test 5 — 15 Questions

Question 1

A network engineer sees the following event in the firewall logs: 'STATUS: intrusion prevented, action: drop, signature: "SQL Injection - SELECT"' on traffic from internal IP to a web server. What type of attack was detected?

Accepted Answer

SQL injection. The log entry explicitly states 'SQL Injection - SELECT' as the signature, which directly identifies the attack as SQL injection. The firewall detected a malicious SQL query (e.g., a SELECT statement with crafted input) in the traffic from an internal IP to a web server and dropped it, preventing the attack. SQL injection exploits improper input validation in web applications to manipulate backend databases.

Answer

Command injection

Answer

Buffer overflow

Answer

Cross-site scripting

Question 2

A Cisco Firepower sensor is generating a high number of false positives from a rule that triggers on large ICMP packets. The analyst suspects the rule threshold is too low. Which tuning action most effectively reduces false positives while maintaining detection of actual attacks?

Accepted Answer

Increase the packet size threshold.. Increasing the packet size threshold (Option D) directly addresses the root cause of the false positives: the rule is triggering on legitimate large ICMP packets that are below the actual attack size. By raising the threshold to a value that still captures known attack vectors (e.g., ICMP echo requests exceeding 65,535 bytes in a fragmented attack), the sensor reduces noise while preserving detection of true malicious oversized packets. This is the most effective tuning action because it adjusts the detection parameter without disabling or bypassing the rule.

Answer

Change the rule action from alert to drop.

Answer

Disable the rule entirely.

Answer

Add an exception for trusted source IPs.

Question 3

During a security incident, an analyst captures network traffic and observes multiple connections from an internal host to a remote IP on port 4444, with irregular packet timing and small payloads. Which type of activity is most likely indicated?

Accepted Answer

C2 beaconing. The observed traffic—multiple connections from an internal host to a remote IP on TCP port 4444, with irregular timing and small payloads—is a classic signature of command-and-control (C2) beaconing. Attackers often use non-standard high ports like 4444 to evade detection, and the irregular intervals (jitter) are intentionally introduced to avoid pattern-based anomaly detection, while small payloads minimize data transfer and reduce the chance of triggering network thresholds.

Answer

DNS tunneling

Answer

File transfer

Answer

VoIP communication

Question 4

Which best practice helps ensure accurate network intrusion analysis when reviewing logs from multiple sources?

Accepted Answer

Use synchronized time across all devices.. Synchronized time (via NTP) ensures that logs from different sources share a consistent timestamp, which is critical for correlating events across network devices during intrusion analysis. Without time synchronization, an attacker's actions might appear out of order or be missed entirely, leading to inaccurate incident reconstruction.

Answer

Disable all logging except firewall logs.

Answer

Rely solely on automated analysis tools.

Answer

Store logs in different formats for each source.

Question 5

An analyst examines a PCAP file and sees a series of HTTP POST requests to an external server with Base64-encoded payloads in the request body. The payloads decode to small text strings. Which type of data exfiltration technique is being used?

Accepted Answer

HTTP data exfiltration. The analyst observes HTTP POST requests carrying Base64-encoded payloads in the request body that decode to small text strings. This is a classic indicator of HTTP data exfiltration, where sensitive data is encoded and sent over HTTP to an external server, bypassing security controls by blending with normal web traffic.

Answer

Session hijacking

Answer

DNS exfiltration

Answer

HTTP tunneling

Question 6

In Security Onion, an analyst runs 'squert' and sees a high number of alerts from a single source IP across multiple destination ports. What is the most likely cause?

Accepted Answer

Port scan. Squert is a web interface for Sguil in Security Onion that visualizes alert data from the intrusion detection system (IDS). A high number of alerts from a single source IP targeting multiple destination ports is a classic signature of a port scan, where the attacker probes a range of ports on one or more targets to discover open services. The IDS triggers multiple alerts because each probe (e.g., SYN packets to different ports) matches a detection rule, such as those for TCP SYN scans.

Answer

Denial of service

Answer

SQL injection

Answer

Phishing attack

Question 7

An analyst notices a series of SYN packets sent to a host at increasing speed, with no SYN-ACK replies. What kind of attack is this?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a rapid succession of SYN packets to a target host without completing the handshake. The target allocates resources for each half-open connection, eventually exhausting its connection table and denying service to legitimate traffic. The absence of SYN-ACK replies confirms the attacker is not responding to the handshake, a hallmark of this volumetric denial-of-service technique.

Answer

SSL stripping

Answer

ARP spoofing

Answer

Smurf attack

Question 8

A Cisco Firepower appliance generates an intrusion specific event with the message 'MALWARE-CNC generic command and control traffic detected'. The analyst needs to determine if the alert is a true positive. Which additional data source would provide the most corroborating evidence?

Accepted Answer

DNS query logs. DNS query logs are the most corroborating evidence because malware command-and-control (C2) traffic often relies on DNS to resolve the IP address of the C2 server. A sudden spike in NXDOMAIN responses, queries to algorithmically generated domains (DGA), or requests to known malicious domains in the DNS logs would directly confirm the C2 activity. This aligns with the 'MALWARE-CNC' signature, which specifically targets C2 communication patterns.

Answer

Application control logs

Answer

URL filtering logs

Answer

NetFlow records

Question 9

Which two characteristics are commonly associated with a distributed denial-of-service (DDoS) attack?

Accepted Answer

High volume of traffic from multiple sources. A DDoS attack is characterized by a high volume of traffic originating from multiple compromised sources (a botnet) to overwhelm a target. This distributed nature distinguishes it from a DoS attack, which typically uses a single source. The goal is to exhaust the target's bandwidth, processing capacity, or application resources, causing denial of service for legitimate users.

Answer

Multiple failed login attempts

Answer

Slow application response time

Answer

Traffic from a single IP address

Question 10

Which three steps are part of the network intrusion analysis process according to Cisco best practices?

Accepted Answer

Collection. Collection is correct because the network intrusion analysis process begins with gathering raw data from sources such as NetFlow, syslogs, and packet captures (PCAP). This step ensures that all relevant evidence is preserved for subsequent detection and analysis, aligning with Cisco's best practices for incident response.

Answer

Prevention

Answer

Remediation

Question 11

Which two pieces of evidence are strong indicators of compromise (IOC) in network traffic?

Accepted Answer

Communication with a known malicious IP address. Communication with a known malicious IP address is a strong indicator of compromise because it directly suggests the host is interacting with a command-and-control (C2) server or a malware distribution point. Threat intelligence feeds and blocklists (e.g., AlienVault OTX, MISP) provide curated lists of known malicious IPs; matching traffic to these lists provides high-fidelity evidence of an active compromise.

Answer

Regular DNS queries to corporate DNS servers

Answer

Normal SMTP traffic to internal mail server

Answer

Standard HTTP traffic to a known content delivery network

Question 12

Based on the exhibit, what action should the analyst take to further investigate this alert?

Accepted Answer

Extract the URL from the alert and check the file hash.. The analyst should extract the URL from the alert and check the file hash because the alert indicates a potential malware download via HTTP. By retrieving the file referenced in the URL, the analyst can compute its hash (e.g., MD5, SHA256) and compare it against known threat intelligence databases (e.g., VirusTotal) to confirm maliciousness and identify the specific malware family. This directly validates whether the detected event is a true positive and provides actionable indicators for containment.

Answer

Search the PCAP for the same signature ID.

Answer

Perform a DNS lookup on the destination IP.

Answer

Check the firewall logs for any blocked connections.

Question 13

Given the syslog message, which additional data would best confirm the event as a true positive?

Accepted Answer

URL filtering logs for traffic to 203.0.113.10. The syslog message likely indicates a security event such as a connection to a known malicious IP (203.0.113.10). URL filtering logs provide the specific HTTP/HTTPS request details (e.g., URI, user agent, category) that can confirm whether the traffic was intentional and malicious, rather than a false positive from a benign service or misconfiguration.

Answer

VPN logs for user authentication

Answer

Antivirus logs on 10.0.0.5

Answer

NetFlow data showing other connections from 10.0.0.5

Question 14

Based on the exhibit, which host is likely engaged in data exfiltration?

Accepted Answer

10.0.0.1. Host 10.0.0.1 is likely engaged in data exfiltration because the exhibit shows a large volume of outbound TCP traffic from this IP to an external destination on port 443 (HTTPS), with a significantly higher byte count compared to other hosts. This pattern is consistent with data being encrypted and sent to an external server, a common exfiltration technique to bypass inspection.

Answer

10.0.0.3

Answer

10.0.0.2

Answer

None of the above

Question 15

An analyst notices an intrusion alert triggered by an internal host scanning multiple ports on a single external IP address. The signature is 'Port Scan'. Which of the following is the most likely cause?

Accepted Answer

Network mapping tool. A port scan targeting multiple ports on a single external IP is the classic behavior of network mapping tools like Nmap or Masscan. These tools systematically probe ports to discover open services, which is distinct from the random or sequential scanning patterns of malware or the limited connections of normal user activity.

Answer

Misconfigured service

Answer

Malware spreading

Answer

Normal user activity