212-89 Network Incidents — 10 Questions

Question 1

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

http-user-agent. In Palo Alto threat logs, the application-specific details or specific threat-id logs often contain the HTTP headers including the User-Agent.

Answer

rule-name

Answer

action

Answer

source-ip

Question 2

You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?

Accepted Answer

inspect smb. The Cisco ASA uses the 'inspect smb' command within a policy-map to trigger the inspection engine for SMB protocols.

Answer

filter smb-exploit

Answer

access-list permit any

Answer

nat dynamic

Question 3

During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?

Accepted Answer

switchport access vlan 99. The 'switchport access vlan [id]' command is the standard way to assign a switch port to a specific VLAN.

Answer

shutdown vlan 99

Answer

vlan isolation enable

Answer

switchport trunk vlan 99

Question 4

An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?

Accepted Answer

ip arp inspection validate src-mac. Dynamic ARP Inspection (DAI) relies on DHCP snooping to validate ARP packets, preventing MAC spoofing.

Answer

snmp-server enable

Answer

ip access-group

Answer

switchport port-security

Question 5

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

Accepted Answer

IN_BYTES. The 'BYTES' or 'IN_BYTES' field in NetFlow records tracks the total octets transferred during the flow, critical for identifying large data transfers.

Answer

PROTOCOL

Answer

IPV4_SRC_ADDR

Answer

LAST_SWITCHED

Question 6

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling often uses non-standard, long, or high-entropy subdomains to encode data.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 7

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

Accepted Answer

Source IP Address. Source IP address is the common attribute between a Windows logon log and a network flow record.

Answer

Target Username

Answer

Process Name

Answer

Event Correlation ID

Question 8

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Accepted Answer

tcp.port == 3389 && ip.src == 192.168.1.50. Filtering by protocol and source IP is essential to isolate traffic. tcp.port == 3389 isolates RDP, while ip.src filters the origin.

Answer

tcp.flags.syn == 1 && ip.src == 192.168.1.50

Answer

data.data == 3389

Answer

rdp.data && ip.dst == 192.168.1.50

Question 9

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 10

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address