200-201 Network Intrusion Analysis Practice Test 6 — 15 Questions

Question 1

An IDS generates an alert for a signature that matches HTTP traffic containing 'cmd.exe' in the URI. The analyst checks the packet and sees the URI is actually 'cmd.exe?help'. What should the analyst do?

Accepted Answer

Tune the signature to reduce false positives. The IDS signature triggered on the presence of 'cmd.exe' in the URI, but the actual traffic was 'cmd.exe?help', which is a legitimate help request and not an exploitation attempt. Tuning the signature to account for the query string reduces false positives without losing detection capability for actual attacks. This aligns with best practices for IDS management, where signatures are adjusted to match real threat patterns rather than exact strings.

Answer

Block the source IP

Answer

Disable the signature

Answer

Escalate to incident response

Question 2

A security engineer reviews syslog data and sees multiple authentication failures from a single source IP to different SSH servers. The source IP is internal. What does this indicate?

Accepted Answer

Brute-force attack. Multiple authentication failures from a single internal source IP to different SSH servers is a classic indicator of a brute-force attack. The attacker is systematically attempting to guess credentials across multiple targets, which is distinct from a single misconfiguration or user error. This pattern is commonly seen in post-compromise lateral movement or initial foothold attempts within the network.

Answer

User error

Answer

Misconfigured client

Answer

Network scan

Question 3

During a PCAP analysis, an analyst sees an ICMP echo reply packet that is larger than usual (2000 bytes). What is this likely indicating?

Accepted Answer

Ping of death attempt. A standard ICMP echo reply packet has a payload of 56 bytes (or 64 bytes including the ICMP header) for a total IP packet size of 84 bytes. A 2000-byte ICMP echo reply exceeds the maximum allowed size for an ICMP packet (65535 bytes for IPv4, but typical implementations limit the data portion to much smaller values). This oversized packet is characteristic of a Ping of Death attack, where the attacker sends a malformed ICMP packet that, when reassembled, causes a buffer overflow on the target system, leading to a crash or denial of service.

Answer

ICMP flood

Answer

Fragmented packet

Answer

Smurf attack

Question 4

An IPS sensor is configured inline and drops traffic that triggers the signature 'OVERFLOW-ICMP-ECHO', which triggers on ICMP packets with size > 1024 bytes. A network administrator reports that legitimate network monitoring tools using large ICMP packets are being blocked. What is the best course of action?

Accepted Answer

Create a whitelist for the monitoring tool's source IP. Option B is correct because creating a whitelist for the monitoring tool's source IP allows the IPS to continue dropping malicious oversized ICMP packets while permitting legitimate traffic from known, trusted sources. This maintains security for the rest of the network without disabling the signature or changing its mode, which would reduce protection.

Answer

Increase the threshold to 2048

Answer

Disable the signature entirely

Answer

Change the sensor mode to IDS for that signature

Question 5

An analyst is investigating a potential data exfiltration. The logs show a series of DNS queries with subdomains that appear to be base64-encoded strings. Which technique is likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data (e.g., exfiltrated files) into subdomains of DNS queries, which are then sent to a malicious authoritative DNS server controlled by the attacker. The base64-encoded subdomains in the logs are a classic indicator of this technique, as the attacker uses the DNS protocol to bypass network security controls and covertly transmit data.

Answer

DNS amplification

Answer

Fast flux

Answer

Domain generation algorithm

Question 6

An analyst receives a syslog message with facility 'authpriv' and severity '3'. What does severity 3 indicate?

Accepted Answer

Error. Syslog severity levels range from 0 (Emergency) to 7 (Debug). Severity 3 corresponds to 'Error', which indicates error conditions that require attention but are not immediately critical. This is defined in RFC 5424, where level 3 is explicitly labeled 'Error' and is used for conditions such as configuration failures or service degradation.

Answer

Emergency

Answer

Critical

Answer

Alert

Question 7

A network engineer is configuring a Cisco Firepower IPS. To reduce false positives from legitimate updates, which action should be taken?

Accepted Answer

Enable adaptive profile. Enabling adaptive profile allows the IPS to learn normal traffic patterns and reduce false positives. Whitelisting is also useful but adaptive profiles are specifically designed to reduce false positives dynamically.

Answer

Use a whitelist for the update server

Answer

Disable the signature

Answer

Set the signature to generate only alert

Question 8

An analyst sees an alert for 'SQL injection' but the target is an internal application that only accepts POST requests with JSON data. The alert was triggered by a parameter in the URL. What is the most likely issue?

Accepted Answer

False positive due to mismatch. The alert was triggered by a parameter in the URL, but the target application only accepts POST requests with JSON data. Since SQL injection via a URL parameter is impossible against an application that does not process URL parameters, the alert is a false positive caused by a mismatch between the signature's expected attack vector and the actual application behavior.

Answer

Application vulnerability

Answer

True positive SQL injection

Answer

Signature misconfiguration

Question 9

Which TWO actions are examples of false positive reduction techniques? (Choose two.)

Accepted Answer

Adding destination IP to whitelist. Adding a destination IP to a whitelist (option C) reduces false positives by excluding known benign traffic from triggering alerts. Increasing the signature threshold (option E) reduces false positives by requiring a higher number of matches or a larger event count before an alert is generated, filtering out low-level noise.

Answer

Changing signature action from drop to alert

Answer

Removing the sensor

Answer

Disabling all signatures

Question 10

Which THREE factors should be considered when tuning an IPS signature? (Choose three.)

Accepted Answer

Application protocol. Application protocol (B) is critical because IPS signatures are protocol-aware and must match the specific protocol context (e.g., HTTP, SMTP, DNS) to avoid false positives. Tuning based on the protocol ensures the signature only inspects traffic where the vulnerability or exploit is relevant, such as applying a SQL injection signature only to HTTP traffic.

Answer

Time of day

Answer

Packet length

Question 11

Which TWO types of data are commonly used for network forensics? (Choose two.)

Accepted Answer

Network logs. Network logs (E) are a primary source of evidence in network forensics because they record events such as authentication attempts, firewall actions, and system access. These logs provide a chronological trail of activity that can be correlated with other data to reconstruct an incident. They are commonly used due to their availability and the critical context they offer for identifying malicious behavior.

Answer

Application code

Answer

Hard drive images

Answer

NetFlow records

Answer

Full packet captures

Question 12

Refer to the exhibit. Based on the intrusion event, what is the likely intent of the traffic?

Accepted Answer

Buffer overflow attempt. The intrusion event shows a long string of 'A' characters (0x41) being sent to an HTTP server, which is a classic pattern for a buffer overflow attack. The intent is to overflow a buffer in the web server software, potentially overwriting memory and executing arbitrary code, making D the correct answer.

Answer

Denial of service

Answer

Normal web browsing

Answer

Port scan

Question 13

Refer to the exhibit. What does this syslog message indicate?

Accepted Answer

Denied SSH connection attempt. The syslog message '%SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: admin] [Source: 10.1.1.1] [localport: 22]' indicates a failed login attempt on port 22, which is the default port for SSH. Since the message explicitly shows 'localport: 22' and the login failed, it corresponds to a denied SSH connection attempt, not a successful one or a Telnet attempt (which uses port 23).

Answer

Failed telnet attempt

Answer

Successful SSH connection

Answer

Allowed TCP traffic

Question 14

Refer to the exhibit. What is the effect of this ACL applied to an interface?

Accepted Answer

Allows only HTTP traffic to host 10.0.1.10 and denies all else. The ACL in the exhibit (assuming it is a standard or extended ACL with a permit statement for TCP port 80 to host 10.0.1.10 and an implicit deny all) explicitly permits only HTTP traffic (TCP port 80) to the destination host 10.0.1.10. All other traffic is denied by the implicit deny all at the end of the ACL, making option C correct.

Answer

Allows all traffic to host 10.0.1.10

Answer

Allows any TCP traffic

Answer

Denies all traffic

Question 15

A security analyst is reviewing a Snort alert that triggered on the signature 'ET TROJAN Win.Trojan.Generic'. What is the most likely reason this alert fired?

Accepted Answer

A system infected with a trojan. The Snort signature 'ET TROJAN Win.Trojan.Generic' is designed to detect network traffic patterns or payloads associated with known Trojan malware. When this alert fires, it indicates that the sensor observed data matching the signature's characteristics, most likely from a system that is infected with a Trojan and is communicating with a command-and-control server or performing malicious activity.

Answer

A legitimate Windows update

Answer

A misconfigured firewall

Answer

An attacker attempting to exploit a buffer overflow