When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?
An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?
You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?
During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?
You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?
An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?
You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?
An incident responder is investigating a suspected data exfiltration over HTTPS. The organization uses a next-generation firewall with TLS inspection enabled. Which artifact from the firewall logs would best help identify the exfiltration channel?
A security analyst is reviewing network traffic and observes a large number of TCP RST packets being sent from an internal server to various external IP addresses. The server is not responding to any SYN packets. Which type of network incident is most likely occurring?
A healthcare organization's incident response team detects a workstation repeatedly connecting to an external IP on TCP port 4444. The endpoint's EDR shows a process named 'svchost.exe' with a parent process of 'explorer.exe' and no digital signature. The network team captures traffic and sees a persistent outbound session with periodic small data transfers. Which network-based containment action should the responder take FIRST to disrupt the command-and-control channel while preserving evidence?
You are reviewing a PCAP from a suspected network incident and notice TCP segments where the sequence numbers do not increment across multiple consecutive packets, yet the payload sizes vary. Which network anomaly does this most accurately indicate?
During an investigation of a suspected data exfiltration, an incident responder analyzes a packet capture and observes a series of TCP packets with the PSH flag set and small payload sizes (less than 100 bytes) sent from an internal server to an external IP over port 443. The payloads appear to be encrypted and are sent at regular intervals every 30 seconds. Which of the following BEST characterizes this traffic?
A company's security team is responding to a network incident where an attacker has compromised a workstation and is attempting lateral movement. The team needs to identify potential lateral movement techniques. Which TWO of the following are common lateral movement techniques used by attackers in a Windows environment? (Choose two.)
During a network incident, you observe that an internal host is sending a high volume of ICMP echo requests to various external IP addresses, each with a payload size of 1500 bytes. The responses are also large. Which type of network incident is most likely occurring?
A security analyst notices a large number of outbound DNS queries from a single internal host to various domain names that appear to be randomly generated, such as 'a1b2c3d4e5.com'. The queries are for A records and occur at a high rate. The analyst suspects a domain generation algorithm (DGA) used by malware. Which network-based containment action should be taken to disrupt this activity?
An incident responder is analyzing a network capture and needs to identify the protocol used for a denial-of-service attack that floods a target with SYN packets from spoofed source IP addresses. Which tool is specifically designed to detect this type of attack by monitoring half-open connections?
An incident responder is investigating a suspected network intrusion and observes a series of TCP packets with the RST flag set coming from an external IP to various internal hosts on different ports. The packets are not part of any established connection. What is the MOST likely explanation for this traffic?
During a network incident, you suspect data exfiltration over HTTPS. You have full packet capture but cannot decrypt the traffic. Which network traffic characteristic is most reliable for identifying the exfiltration channel?
A security operations center (SOC) receives an alert about a potential network incident involving a compromised server. The server is communicating with an external IP address using the Server Message Block (SMB) protocol over TCP port 445. The SOC analyst needs to determine if this is lateral movement or data exfiltration. Which two of the following network forensic artifacts would best help distinguish between these two activities? (Choose two.)
During a network incident, you suspect that an attacker has established a covert channel using the Internet Control Message Protocol (ICMP). You have a packet capture and want to determine if data is being exfiltrated via ICMP echo request and reply packets. Which characteristic of the ICMP packets would most reliably indicate data exfiltration?
You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?
You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?
During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?
You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?
A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?
During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?
You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?
Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?
A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?
During a network incident, you capture traffic and notice a workstation repeatedly sending TCP SYN packets to a single external IP on port 443, but the external host never responds. The workstation then sends the same SYN to a different external IP on port 443. Which network artifact best characterizes this behavior?
During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?
A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would most likely be observed in the network traffic or ARP cache? (Choose two.)
A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?
An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traffic is encrypted. The workstation's user reports that the computer is running slowly. Which type of network incident is most likely indicated?
A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?
A network incident has been declared due to a suspected data exfiltration. You are reviewing network flow data to identify the exfiltration channel. Which TWO of the following characteristics are most indicative of data exfiltration over a covert channel? (Choose two.)
During a network incident, you observe a large volume of ARP replies from a single MAC address claiming to be the default gateway. Which containment action should you take first to mitigate the immediate threat while preserving evidence for forensic analysis?
A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)
A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?
A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)
A security analyst is reviewing firewall logs and notices a large number of 'deny' events from an internal host to various external IP addresses on different ports. The internal host is a user workstation that should only access a limited set of external services. Which of the following is the MOST likely cause of these deny events?
During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?
A security analyst is reviewing a packet capture from a suspected compromised workstation. The analyst notices a series of DNS queries for random-looking subdomains such as 'a1b2c3d4.evil.com', 'e5f6g7h8.evil.com', and 'i9j0k1l2.evil.com'. Each query is followed by a TXT record response containing long base64-encoded strings. The analyst suspects data exfiltration. Which network forensic technique would best confirm and extract the exfiltrated data from this traffic?
During a network incident, you observe that an internal host is communicating with an external IP address on TCP port 8080. The traffic is HTTP and contains periodic GET requests to '/update.php' with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' but the response body is encrypted binary data. You suspect this is command-and-control (C2) communication. Which network forensic artifact would most directly reveal the C2 protocol structure and commands being sent?
A network incident responder is analyzing a packet capture and notices a large number of TCP SYN packets sent from various source IP addresses to a single destination IP address on port 80, but no corresponding SYN-ACK packets. The destination server is unresponsive. Which type of network incident is most likely occurring?