212-89 Network Incidents Practice Test 3 — 15 Questions

Question 1

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Accepted Answer

local0. Syslog facilities local0 through local7 are reserved for local or custom use, and network devices (routers, switches, firewalls) conventionally use local0 (or another local facility) to tag audit and event logs sent to a central syslog server. This lets administrators separate device-generated audit logs from system daemons like kernel, cron, or mail in the central collector's configuration. Using local0 ensures the logs are routed and stored according to the organization's audit retention policy.

Answer

kernel

Answer

cron

Answer

mail

Question 2

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

Accepted Answer

Data field. In ICMP tunneling, attackers encapsulate data within the payload of ICMP echo request packets, which is the Data field. This field can carry arbitrary data, allowing covert exfiltration. The other fields are used for control and routing, not for carrying variable payloads.

Answer

Checksum field

Answer

Sequence number

Answer

TTL field

Question 3

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

Accepted Answer

File > Export Objects > HTTP. Wireshark's File > Export Objects > HTTP feature reconstructs and extracts files transferred over HTTP by reassembling TCP streams and parsing HTTP headers (Content-Type, Content-Length, Content-Disposition). It presents a list of all objects seen in the capture and allows saving them directly to disk, which is the standard method for recovering files from a PCAP during network forensics.

Answer

Statistics > HTTP > Reassemble

Answer

Edit > Follow > Stream Extract

Answer

Analyze > Extract File

Question 4

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

Accepted Answer

Malware attempting to reach a C2 server. Internal hosts attempting to reach external IPs blocked by the egress policy are a common indicator of a malware beaconing attempt or an infected host trying to reach a C2.

Answer

IP address conflict

Answer

Normal user browsing activity

Answer

Hardware failure on the firewall

Question 5

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

Accepted Answer

Examine the process list on the web server to identify the source of the connection. A high volume of connections from a web server to an internal database on port 3306 is suspicious because web servers typically connect to databases, but a sudden spike or unusual pattern may indicate lateral movement or data exfiltration. The most appropriate next step is to examine the process list on the web server to identify which process is initiating the connections — this could reveal a compromised web application, a malicious script, or an attacker's tool. This action is non-disruptive and directly identifies the source.

Answer

Reset the database server credentials

Answer

Block the web server access entirely

Answer

Increase the flow timeout settings

Question 6

What is the purpose of 'Network Segmentation' during an active network incident?

Accepted Answer

Containment of the attack by limiting communication paths. Network segmentation during an active incident isolates affected segments from the rest of the environment, limiting the attacker's ability to move laterally, exfiltrate data, or reach command-and-control infrastructure. By restricting communication paths (via VLANs, ACLs, firewall rules, or microsegmentation), responders contain the blast radius while preserving critical business traffic. This is a core containment tactic in incident response frameworks like NIST SP 800-61.

Answer

Eliminating the need for firewalls

Answer

Automatic removal of malware

Answer

Increasing network throughput

Question 7

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?

Accepted Answer

Reverse DNS (PTR) lookup of destination IPs. Reverse DNS (PTR) lookup of destination IPs (C) is effective because resolving suspicious destination addresses to hostnames can reveal attacker-controlled domains, VPS providers, or naming patterns tied to C2 infrastructure. WHOIS registration data analysis (D) is effective because it exposes registrant details, registrar, creation dates, and name servers that can link multiple malicious domains or IP ranges to the same threat actor or campaign. Threat intelligence reputation checks (E) are effective because querying destination IPs/domains against feeds, sandboxes, and IOC databases can flag known C2 servers, malware families, or adversary infrastructure. Enabling SNMP on all edge hosts (A) is not a forensics technique for identifying C2; it expands the attack surface and exposes device management data. Disabling ICMP echo responses (B) is a hardening/stealth measure, not an investigative method, and it does not reveal C2 endpoints.

Answer

Enabling SNMP on all edge hosts

Answer

Disabling ICMP echo responses

Question 8

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

Accepted Answer

High volume of TCP SYN packets to multiple ports. Option B is correct because a compromised host performing port scanning typically sends a high volume of TCP SYN packets to many ports on one or more targets, which is the classic signature of a SYN scan used for network discovery. Option C is correct because ARP scanning tools (e.g., arp-scan, nmap -PR) flood the local subnet with ARP requests to enumerate live hosts, producing a high volume of ARP traffic that is a common indicator of internal discovery activity. Option A is not a discovery indicator, since DHCP release messages simply relinquish an existing lease and are not associated with host enumeration. Option D is unrelated, as HTTP 404 errors reflect web content requests rather than network discovery. Option E is not a network-based discovery indicator in the same sense, because DNS queries for internal hostnames are normal resolver behavior and do not by themselves indicate scanning or enumeration of the network.

Answer

Increase in DHCP release messages

Answer

Multiple HTTP 404 errors

Answer

Frequent DNS queries for internal hostnames

Question 9

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Accepted Answer

DNS query logs for destination domain lookup. DNS query logs (B) are critical because exfiltration often relies on DNS tunneling or resolving attacker-controlled domains, and these logs reveal the queried names, record types, and client IPs involved in the lookup. Firewall logs (D) are essential since they record allowed and denied outbound connections, showing which internal hosts attempted to reach external IPs and ports during the incident window. NetFlow records (E) provide flow-level metadata such as source/destination IPs, ports, protocol, and byte/packet counts, enabling analysts to spot abnormally large or long-duration outbound transfers indicative of data exfiltration. NTP server logs (A) only show time synchronization activity and do not capture payload, connection, or transfer details relevant to exfiltration. Print server logs (C) relate to printing/spooling events and have no bearing on network-based data movement to external destinations.

Answer

NTP server logs

Answer

Print server logs

Question 10

Which TWO of the following are common signs of a compromised switch in a local area network?

Accepted Answer

Unrecognized trunk ports enabled. Option A is correct because an unrecognized or unauthorized trunk port enabled on a switch is a classic indicator of compromise—attackers configure trunk links (e.g., 802.1Q) to carry traffic for multiple VLANs and perform VLAN hopping or intercept traffic that should remain segmented. Option D is correct because unexpected MAC address table growth indicates MAC flooding, where an attacker overwhelms the switch's CAM table with spoofed source MACs, forcing it into fail-open hub behavior so traffic is flooded to all ports for sniffing. The unmarked options do not belong: normal spanning-tree convergence (B) is expected healthy behavior, decreased CPU usage (C) is not a compromise sign (attacks typically raise CPU load), and a stable port security status (E) reflects normal, secure operation rather than an indicator of compromise.

Answer

Normal spanning-tree convergence

Answer

Decreased CPU usage on the switch

Answer

Stable port security status

Question 11

Which THREE of the following are key components of a network-based containment strategy?

Accepted Answer

Isolation of the compromised segment from the rest of the network. Option A is correct because isolating the compromised network segment (for example, by moving it to a quarantine VLAN or applying ACLs on the switch/router) prevents lateral movement of the attacker to other hosts while containment is underway. Option B is correct because forcibly terminating active sessions (resetting TCP connections, killing authenticated sessions, or invalidating tokens) cuts off the attacker's existing foothold and command-and-control channels. Option C is correct because egress filtering at the perimeter blocks outbound traffic to known malicious IPs/domains, stopping data exfiltration and C2 callbacks, which is a core part of containing a network-based incident. Option D is not a containment measure; extending DHCP lease times only affects address assignment duration and does nothing to stop an active intrusion. Option E is not a containment action either, since wholesale hardware replacement is a costly remediation/recovery step, not a strategy for limiting the spread of an ongoing network-based attack.

Answer

Increasing the DHCP lease time

Answer

Installing new hardware across the network

Question 12

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

Accepted Answer

Unusual use of NTLM for RDP authentication. Option A is correct because in a domain environment RDP authentication normally uses Kerberos, so a shift to NTLM for RDP (e.g., via Restricted Admin mode or credential-based attacks) is a strong indicator of lateral movement attempts. Option D is correct because mstsc.exe is the native RDP client, and its use with unusual flags (such as /admin, /restrictedAdmin, or /v to non-standard hosts) can signal an attacker pivoting between systems. Option E is correct because RDP logins originating from workstations to servers are atypical in most domain environments, where administrative RDP typically flows from jump hosts or management stations, making such connections a hallmark of lateral movement. Option B is incorrect because SNMP is a network management protocol unrelated to RDP session behavior. Option C is incorrect because HTTPS traffic is encrypted web traffic and does not characterize RDP-based lateral movement.

Answer

Increased usage of SNMP

Answer

High volume of HTTPS traffic

Question 13

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Accepted Answer

Maintain a strict chain of custody for all PCAP files. Option A is correct because maintaining a strict chain of custody for all PCAP files ensures that captured evidence remains admissible and its integrity is verifiable in legal or disciplinary proceedings, documenting who handled the files, when, and how. Option C is correct because capturing traffic via a SPAN port or a network tap provides a non-intrusive, passive copy of live traffic without disrupting production flows or altering the packets, which is essential for accurate forensic analysis. Options B, D, and E are not best practices: disabling logging destroys valuable evidence and does not meaningfully prioritize bandwidth, rebooting network devices clears volatile buffers and loses forensic artifacts, and modifying firewall rules to allow all traffic contaminates the environment and changes the very conditions being investigated.

Answer

Disable all logging to prioritize bandwidth

Answer

Reboot the network devices to clear the buffer

Answer

Modify the firewall rule to allow all traffic for analysis

Question 14

A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?

Accepted Answer

TCP SYN flood. The scenario describes a high volume of TCP SYN packets from spoofed sources to a single server, with no SYN-ACK replies and a nearly full connection table. This matches the behavior of a TCP SYN flood, where the attacker exhausts the server's resources by initiating many half-open connections. Other attacks like UDP amplification, Smurf, or DNS tunneling do not produce this specific pattern.

Answer

UDP amplification attack

Answer

DNS tunneling

Answer

Smurf attack

Question 15

During a network incident, you capture traffic and notice a workstation repeatedly sending TCP SYN packets to a single external IP on port 443, but the external host never responds. The workstation then sends the same SYN to a different external IP on port 443. Which network artifact best characterizes this behavior?

Accepted Answer

TCP SYN scan targeting a single port across multiple hosts. The workstation is sending TCP SYN packets to a single port on multiple external IP addresses without completing the three-way handshake. This is characteristic of a TCP SYN scan, often used for reconnaissance to identify live hosts and open ports. The incident handler should recognize this as scanning activity, which may precede an attack and warrants further investigation.

Answer

TCP session hijacking attempt

Answer

Slowloris denial-of-service attack

Answer

UDP flood denial-of-service attack