212-89 Network Incidents Practice Test 2 — 15 Questions

Question 1

During a network incident, you observe that an internal host is sending a high volume of ICMP echo requests to various external IP addresses, each with a payload size of 1500 bytes. The responses are also large. Which type of network incident is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ICMP tunneling for data exfiltration. The host is sending ICMP echo requests with an unusually large payload of 1500 bytes to multiple external IPs, and the responses are also large. Normal ICMP ping traffic uses small payloads. The large payload size indicates that data is being embedded in the ICMP packets, which is characteristic of ICMP tunneling for data exfiltration. Incident handlers should capture and analyze the payload to confirm the exfiltration.

Answer

ICMP flood denial-of-service attack

Answer

Network reconnaissance via ICMP ping sweep

Answer

Smurf attack amplification

Question 2

A security analyst notices a large number of outbound DNS queries from a single internal host to various domain names that appear to be randomly generated, such as 'a1b2c3d4e5.com'. The queries are for A records and occur at a high rate. The analyst suspects a domain generation algorithm (DGA) used by malware. Which network-based containment action should be taken to disrupt this activity?

Accepted Answer

Configure the internal DNS server to sinkhole the suspicious domains.. Sinkholing the suspicious domains on the internal DNS server is a targeted containment that disrupts the DGA-based communication while allowing legitimate DNS queries. It prevents the malware from resolving its C2 domains and can help identify other infected hosts. Blocking all DNS or all traffic is too disruptive and not necessary.

Answer

Block outbound DNS queries from the internal host at the firewall.

Answer

Disable the DNS service on the internal host.

Answer

Apply a firewall rule to block all outbound traffic from the internal host.

Question 3

An incident responder is analyzing a network capture and needs to identify the protocol used for a denial-of-service attack that floods a target with SYN packets from spoofed source IP addresses. Which tool is specifically designed to detect this type of attack by monitoring half-open connections?

Accepted Answer

Snort with the 'flow:to_server,established' option. A SYN flood creates many half-open connections, which are best detected by a stateful intrusion detection system like Snort. The 'flow:to_server,established' option enables Snort to track TCP sessions and alert when there is an excessive number of SYN packets without corresponding ACKs. Other tools either lack stateful tracking or are not designed for real-time detection of this specific attack.

Answer

Snort with the 'flow:stateless' option

Answer

NetFlow analyzer monitoring TCP flags

Answer

tcpdump with a filter for 'tcp[tcpflags] & tcp-syn != 0'

Question 4

An incident responder is investigating a suspected network intrusion and observes a series of TCP packets with the RST flag set coming from an external IP to various internal hosts on different ports. The packets are not part of any established connection. What is the MOST likely explanation for this traffic?

Accepted Answer

A denial-of-service attack attempting to reset connections.. The unsolicited RST packets from an external IP to multiple internal hosts on different ports indicate a deliberate attempt to reset TCP connections, causing a denial of service. This can disrupt legitimate communications and may be a smokescreen for other attacks. It is not a port scan or a simple firewall misconfiguration, as those would have different patterns.

Answer

A legitimate network device performing TCP reset for load balancing.

Answer

A misconfigured firewall sending RST packets.

Answer

A port scan using TCP RST packets.

Question 5

During a network incident, you suspect data exfiltration over HTTPS. You have full packet capture but cannot decrypt the traffic. Which network traffic characteristic is most reliable for identifying the exfiltration channel?

Accepted Answer

Outbound traffic volume significantly exceeding inbound traffic for a sustained period. When encryption prevents content inspection, traffic analysis becomes essential. A sustained outbound traffic volume that significantly exceeds inbound traffic is a strong indicator of data exfiltration, as the attacker is sending data out while receiving little in return. This asymmetry is observable in full packet captures by comparing byte counts per flow. Other characteristics like periodicity, port usage, or TLS extensions are less specific and can be present in benign traffic.

Answer

Use of non-standard ports for HTTPS traffic

Answer

Periodic outbound connections to a specific IP with consistent packet sizes

Answer

Presence of TLS heartbeat extensions in the ClientHello

Question 6

A security operations center (SOC) receives an alert about a potential network incident involving a compromised server. The server is communicating with an external IP address using the Server Message Block (SMB) protocol over TCP port 445. The SOC analyst needs to determine if this is lateral movement or data exfiltration. Which two of the following network forensic artifacts would best help distinguish between these two activities? (Choose two.)

Accepted Answer

The SMB command types used, such as read, write, or execute.. The correct answers are the volume and direction of data transferred and the SMB command types used. These artifacts directly reflect the intent: large outbound data suggests exfiltration, while inbound writes or executes suggest lateral movement. Command types like read vs. write further clarify the action. Other artifacts like TCP details, DNS history, or SMB security settings do not provide the necessary behavioral distinction.

Answer

The SMB signing and encryption status of the session.

Answer

The TCP handshake details and window sizes.

Answer

The DNS resolution history for the external IP address.

Question 7

During a network incident, you suspect that an attacker has established a covert channel using the Internet Control Message Protocol (ICMP). You have a packet capture and want to determine if data is being exfiltrated via ICMP echo request and reply packets. Which characteristic of the ICMP packets would most reliably indicate data exfiltration?

Accepted Answer

The ICMP packets contain a payload that is larger than the standard 32 bytes and appears non-random.. The correct answer is that the ICMP packets contain a payload larger than the standard 32 bytes and appear non-random. Standard ICMP echo payloads are small and often filled with predictable data. A larger, non-random payload suggests that actual data is being embedded, which is a hallmark of ICMP tunneling for exfiltration. Other characteristics like frequency, source IP, or type code are less specific to data exfiltration.

Answer

The ICMP packets have a source IP address that does not match the internal network range.

Answer

The ICMP packets are sent at a high frequency to many different destination IP addresses.

Answer

The ICMP packets use a type code other than 8 (echo request) or 0 (echo reply).

Question 8

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling encodes data in the subdomain portion of DNS queries, and because DNS labels are limited to 63 characters, attackers pack them with long, random-looking (high-entropy) strings to maximize data throughput. Standard recursive lookups use short, human-readable domain names, so unusually long, high-entropy subdomains are the strongest indicator of a tunnel. Tools like iodine and dnscat2 produce exactly this pattern.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 9

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

Accepted Answer

Source IP Address. Source IP address is the common attribute between a Windows logon log and a network flow record.

Answer

Target Username

Answer

Process Name

Answer

Event Correlation ID

Question 10

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Accepted Answer

tcp.port == 3389 && ip.src == 192.168.1.50. The filter 'tcp.port == 3389 && ip.src == 192.168.1.50' is correct because RDP operates over TCP port 3389, and the ip.src clause restricts capture to traffic originating from the specific workstation under investigation. This isolates the RDP session from that source to the domain controller, allowing the analyst to inspect the session for credential dumping artifacts or unusual keystroke patterns.

Answer

tcp.flags.syn == 1 && ip.src == 192.168.1.50

Answer

data.data == 3389

Answer

rdp.data && ip.dst == 192.168.1.50

Question 11

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 12

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address

Question 13

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

Accepted Answer

Microsoft-Windows-PowerShell/Operational. The Microsoft-Windows-PowerShell/Operational log records detailed PowerShell activity, including remote command execution via WinRM (PowerShell Remoting). When an analyst runs Invoke-Command or Enter-PSSession against a remote host, the remote endpoint writes events such as Event ID 4103 (module logging) and 4104 (script block logging) to this log, providing the actual command content executed. The Security log records authentication (4624/4625) but not the payload of remote commands, making the PowerShell Operational log the priority source for confirming execution.

Answer

Application Log

Answer

Security Log

Answer

System Log

Question 14

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Accepted Answer

Implement ACLs to block TCP 445 between segments. Blocking TCP 445 (SMB) at the boundary between network segments is the most effective way to stop worm-like lateral movement.

Answer

Disable DNS resolution on the host

Answer

Enable DHCP snooping

Answer

Flush the ARP cache

Question 15

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Accepted Answer

Consistent interval between connections. Heartbeat-style beaconing is characterized by malware 'calling home' at regular, predictable intervals (e.g., every 60 seconds) to receive commands or exfiltrate data. This consistent timing creates a recognizable pattern in network flow data that distinguishes C2 traffic from normal user-driven traffic, which is bursty and irregular. Connection speed, encryption, and packet size can all be manipulated or are common in legitimate traffic, so they are far weaker indicators.

Answer

High-speed connection speed

Answer

Use of HTTPS

Answer

Randomized packet size