212-89 Network Incidents Practice Test 4 — 15 Questions

Question 1

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The host is communicating with a command-and-control server using HTTPS beaconing.. The correct answer is the one describing command-and-control beaconing. The scenario describes short, periodic connections with small, consistent data transfers to an external IP on TCP port 443. This is a classic indicator of malware beaconing, where the compromised host checks in with a C2 server at regular intervals. The use of HTTPS helps the traffic evade detection by blending with legitimate encrypted traffic.

Answer

The host is downloading a large file over HTTPS.

Answer

The host is performing a vulnerability scan against the external IP.

Answer

The host is using a peer-to-peer file sharing application.

Question 2

A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would most likely be observed in the network traffic or ARP cache? (Choose two.)

Accepted Answer

Gratuitous ARP replies claiming an IP address already in use. ARP poisoning involves manipulating ARP caches to redirect traffic. Two key indicators are multiple IP addresses mapping to the same MAC address (often the attacker's) and gratuitous ARP replies that overwrite legitimate mappings. These directly reflect the attack mechanism. Other indicators like DNS failures, ICMP redirects, or TCP SYN floods are not specific to ARP poisoning and would mislead the investigation.

Answer

Frequent ICMP redirect messages from the default gateway

Answer

A sudden increase in DNS query failures

Answer

A high volume of TCP SYN packets from a single host

Question 3

A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?

Accepted Answer

The server is using DNS tunneling to exfiltrate data.. The correct answer is DNS tunneling. A large outbound data transfer over TCP port 53 from an internal server to an external IP is highly suspicious because normal DNS traffic is small and usually UDP-based. Attackers use DNS tunneling to encode stolen data in DNS queries, exploiting the fact that DNS is often allowed through firewalls. This allows them to exfiltrate data stealthily.

Answer

The server is updating its DNS records dynamically.

Answer

The server is querying a large number of DNS records for a legitimate application.

Answer

The server is performing a legitimate DNS zone transfer.

Question 4

An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traffic is encrypted. The workstation's user reports that the computer is running slowly. Which type of network incident is most likely indicated?

Accepted Answer

Command and control (C2) communication. The workstation is communicating with an external IP on port 4444 with encrypted traffic, and the user reports slow performance. Port 4444 is a default port for Metasploit and other attack tools, and encrypted C2 channels are common in malware. The slow performance could be due to the malware's operations. This is a classic sign of a compromised host under command and control.

Answer

Peer-to-peer file sharing

Answer

Legitimate remote desktop access

Answer

DNS tunneling

Question 5

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

Accepted Answer

HTTP flood. The scenario describes a high volume of HTTP requests with complex query strings targeting a search function, leading to CPU exhaustion. This matches an HTTP flood, a layer 7 denial-of-service attack that exploits resource-intensive operations. Other attacks like XSS, SQL injection, or directory traversal do not primarily cause CPU spikes through such requests.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

Directory traversal

Question 6

A network incident has been declared due to a suspected data exfiltration. You are reviewing network flow data to identify the exfiltration channel. Which TWO of the following characteristics are most indicative of data exfiltration over a covert channel? (Choose two.)

Accepted Answer

Regular, small outbound DNS queries to a single external domain. Data exfiltration over covert channels often manifests as large outbound transfers during off-hours or as regular, small DNS queries to a single external domain, which may indicate DNS tunneling. Both patterns deviate from normal business traffic and are designed to avoid detection. Incident handlers should prioritize these anomalies when analyzing flow data to identify the exfiltration channel.

Answer

High volume of inbound traffic from multiple external IPs

Answer

Outbound traffic to a known patch management server

Answer

Inbound email with large attachments from an unknown sender

Question 7

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture network traffic and ARP tables, then isolate the affected VLAN. The immediate threat is ARP spoofing, which can lead to man-in-the-middle attacks. The best first action is to capture volatile evidence (network traffic, ARP caches) before taking containment steps, then isolate the affected VLAN to prevent lateral movement. This preserves forensic artifacts while stopping the attack from spreading. Other options either disrupt evidence, are not immediate, or do not contain the threat at the network level.

Answer

Shut down the switch port where the malicious MAC address is connected

Answer

Configure a static ARP entry for the default gateway on critical hosts

Answer

Enable Dynamic ARP Inspection (DAI) on all access ports

Question 8

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Accepted Answer

Block the external IP address at the perimeter firewall.. Blocking the external IP at the firewall and applying an ACL on the internal router are both network-based containment actions that disrupt the malicious traffic while preserving the server's functionality and evidence. They are targeted and reversible, unlike disconnecting or shutting down the server, which cause unnecessary disruption.

Answer

Run a full malware scan on the database server.

Answer

Disconnect the database server from the network immediately.

Answer

Shut down the database service to prevent further data leakage.

Question 9

A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?

Accepted Answer

The host is infected with malware using ICMP tunneling for data exfiltration.. The correct answer is malware using ICMP tunneling. The scenario describes a sudden spike in ICMP echo requests with consistently large payloads to an external IP, which is a classic sign of ICMP tunneling. Attackers use this technique to exfiltrate data by embedding it in ICMP packets, often bypassing firewall restrictions that allow ping. This allows stealthy data transfer out of the network.

Answer

The host is experiencing a denial-of-service attack from the external IP.

Answer

The host is using a legitimate application that relies on ICMP for keep-alive messages.

Answer

The host is performing a network performance test using ping.

Question 10

A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)

Accepted Answer

Windows Security Event ID 5140 for network share access. To confirm SMB lateral movement, focus on events that show network logons and share access. Event ID 4624 with Logon Type 3 records network logons, which are used when connecting to SMB shares. Event ID 5140 logs access to network shares, including administrative shares. Together, they provide evidence of an attacker using compromised credentials to access remote systems via SMB. Other events either lack specificity or do not directly indicate SMB share access.

Answer

Windows Security Event ID 4776 for credential validation

Answer

Windows Security Event ID 4688 with process name psexec.exe

Answer

Windows Security Event ID 5156 for Windows Filtering Platform connection

Question 11

A security analyst is reviewing firewall logs and notices a large number of 'deny' events from an internal host to various external IP addresses on different ports. The internal host is a user workstation that should only access a limited set of external services. Which of the following is the MOST likely cause of these deny events?

Accepted Answer

The workstation is infected with malware performing port scanning.. The correct answer is malware performing port scanning. The workstation, which should only access a limited set of services, is generating a large number of deny events to various external IPs on different ports. This is a classic sign of port scanning, often performed by malware to find vulnerable targets. The firewall is blocking these unauthorized attempts, resulting in the deny events.

Answer

The workstation's firewall rules are misconfigured, blocking legitimate traffic.

Answer

The workstation is attempting to update its software from multiple sources.

Answer

The workstation is running a legitimate peer-to-peer application.

Question 12

During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?

Accepted Answer

ARP cache poisoning. The workstation is poisoning ARP caches to redirect traffic intended for the DMZ server to itself. The telltale sign is that the Ethernet source MAC belongs to the finance workstation while the IP source is the DMZ server's address, and the workstation's ARP cache incorrectly maps that IP to its own MAC. This man-in-the-middle positioning allows the attacker to intercept or alter traffic before forwarding it.

Answer

MAC flooding

Answer

VLAN hopping

Answer

DHCP starvation

Question 13

A security analyst is reviewing a packet capture from a suspected compromised workstation. The analyst notices a series of DNS queries for random-looking subdomains such as 'a1b2c3d4.evil.com', 'e5f6g7h8.evil.com', and 'i9j0k1l2.evil.com'. Each query is followed by a TXT record response containing long base64-encoded strings. The analyst suspects data exfiltration. Which network forensic technique would best confirm and extract the exfiltrated data from this traffic?

Accepted Answer

Reconstruct the DNS TXT record responses and decode the base64 payloads to recover the exfiltrated data.. The correct answer is to reconstruct the DNS TXT record responses and decode the base64 payloads. DNS tunneling for data exfiltration often uses TXT records to carry encoded data. By extracting and decoding these records from the packet capture, the analyst can recover the exfiltrated information and confirm the incident. Other methods either do not extract data or are not forensic analysis techniques for existing captures.

Answer

Use a DNS sinkhole to redirect the malicious domain to a controlled server and observe subsequent connections.

Answer

Analyze the frequency and timing of DNS queries to determine if they match a known exfiltration pattern.

Answer

Correlate the DNS queries with NetFlow records to identify the volume of data transferred.

Question 14

During a network incident, you observe that an internal host is communicating with an external IP address on TCP port 8080. The traffic is HTTP and contains periodic GET requests to '/update.php' with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' but the response body is encrypted binary data. You suspect this is command-and-control (C2) communication. Which network forensic artifact would most directly reveal the C2 protocol structure and commands being sent?

Accepted Answer

The decrypted payload of the HTTP response body after applying the malware's decryption routine.. The correct answer is to decrypt the HTTP response body using the malware's decryption routine. Since the C2 commands are transmitted in an encrypted binary payload, only decryption can reveal the protocol structure and commands. Other artifacts like headers, TCP metadata, or DNS queries do not contain the encrypted command data and thus cannot provide the necessary insight.

Answer

The HTTP request headers and URI parameters in the packet capture.

Answer

The DNS queries made by the host to resolve the external IP address.

Answer

The TCP sequence numbers and window sizes in the packet capture.

Question 15

A network incident responder is analyzing a packet capture and notices a large number of TCP SYN packets sent from various source IP addresses to a single destination IP address on port 80, but no corresponding SYN-ACK packets. The destination server is unresponsive. Which type of network incident is most likely occurring?

Accepted Answer

A SYN flood denial-of-service attack.. The correct answer is a SYN flood denial-of-service attack. The key indicators are the high volume of TCP SYN packets to a single destination port, the absence of SYN-ACK responses, and the server becoming unresponsive. This exhausts the server's resources, preventing legitimate connections. Other options like port scanning, brute-forcing, or UDP amplification do not match the observed TCP SYN pattern and lack of responses.

Answer

A brute-force attack against a web application.

Answer

A distributed denial-of-service attack using UDP amplification.

Answer

A port scan using TCP SYN packets.