212-89 Network Incidents — Timed 10 Questions

Question 1

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

10 minute time limit — choose an answer to begin.

Accepted Answer

http-user-agent. In Palo Alto threat logs, the application-specific details or specific threat-id logs often contain the HTTP headers including the User-Agent.

Answer

rule-name

Answer

action

Answer

source-ip

Question 2

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

Accepted Answer

IN_BYTES. IN_BYTES in a NetFlow v9 record counts the total number of bytes observed in the flow, making it the direct measure of data volume transferred between hosts. For exfiltration analysis, comparing IN_BYTES across flows to external or unusual destinations reveals how much data left the network. It is the primary field for volumetric analysis in flow-based forensics.

Answer

PROTOCOL

Answer

IPV4_SRC_ADDR

Answer

LAST_SWITCHED

Question 3

You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?

Accepted Answer

inspect smb. The Cisco ASA uses the 'inspect smb' command within a policy-map to trigger the inspection engine for SMB protocols.

Answer

filter smb-exploit

Answer

access-list permit any

Answer

nat dynamic

Question 4

During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?

Accepted Answer

switchport access vlan 99. The 'switchport access vlan [id]' command is the standard way to assign a switch port to a specific VLAN.

Answer

shutdown vlan 99

Answer

vlan isolation enable

Answer

switchport trunk vlan 99

Question 5

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

Accepted Answer

NTLMSSP_AUTH. Pass-the-Hash attacks authenticate using a stolen NTLM hash without knowing the plaintext password. In the NTLMSSP exchange, the NTLMSSP_AUTH message contains the NTLM response (the hash-based challenge response) that the server validates. Detecting this message type in SMB traffic is key because it carries the actual authentication attempt using the hash.

Answer

SMB_COM_OPEN

Answer

NTLMSSP_NEGOTIATE

Answer

SMB_COM_TREE_CONNECT

Question 6

An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?

Accepted Answer

ip arp inspection validate src-mac. Dynamic ARP Inspection (DAI) relies on DHCP snooping to validate ARP packets, preventing MAC spoofing.

Answer

snmp-server enable

Answer

ip access-group

Answer

switchport port-security

Question 7

Which TWO of the following indicators are primary artifacts to look for when investigating potential lateral movement on a Windows network?

Accepted Answer

Event ID 7045 (Service Installation). Service installation and login events (4624/4625) are primary methods for lateral movement.

Answer

Event ID 1000 (Application Error)

Answer

Event ID 4688 (Process Creation)

Answer

Event ID 1102 (Log Cleared)

Question 8

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Option A is correct because masquerading malicious traffic on common ports like 443 (HTTPS) allows the attacker's command-and-control or lateral movement traffic to blend in with legitimate encrypted web traffic, making it difficult for network monitoring tools to distinguish it from normal activity. Option E is correct because embedding data within encrypted SSH tunnels hides the actual payload from deep packet inspection, since the traffic appears as a legitimate SSH session on port 22, effectively concealing lateral movement. Option B is not correct because clear-text Telnet is easily detected by network monitoring and is not a stealthy technique for hiding traffic. Option C is not correct because sending traffic exclusively during business hours may reduce suspicion but does not inherently hide the traffic from detection systems. Option D is not correct because disabling logging on the source host is a host-based anti-forensic technique, not a network traffic-hiding technique for lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 9

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

Accepted Answer

Verify if the IDS has visibility into the decrypted traffic. SSH brute force signatures often require the IDS to perform protocol decoding; if the traffic is encrypted and the IDS lacks the session keys, it can only see the handshake.

Answer

Check if the disk is full

Answer

Reboot the IDS appliance

Answer

Ensure NTP is synchronized

Question 10

An incident responder is investigating a suspected data exfiltration over HTTPS. The organization uses a next-generation firewall with TLS inspection enabled. Which artifact from the firewall logs would best help identify the exfiltration channel?

Accepted Answer

The TLS certificate issuer and common name of the external server. When TLS inspection is enabled, the firewall can decrypt and log detailed information about HTTPS sessions, including the server certificate. The certificate issuer and common name can reveal if the external server is legitimate or suspicious, such as a self-signed certificate or a known malicious domain. This is more specific than generic IP/port or byte counts, and directly aids in identifying the exfiltration channel.

Answer

The HTTP User-Agent string used by the internal host

Answer

The total number of bytes transferred during the session

Answer

The source IP address and port number of the internal host