212-89 Network Incidents — Timed 15 Questions

Question 1

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

15 minute time limit — choose an answer to begin.

Accepted Answer

http-user-agent. In Palo Alto threat logs, the application-specific details or specific threat-id logs often contain the HTTP headers including the User-Agent.

Answer

rule-name

Answer

action

Answer

source-ip

Question 2

You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?

Accepted Answer

inspect smb. The Cisco ASA uses the 'inspect smb' command within a policy-map to trigger the inspection engine for SMB protocols.

Answer

filter smb-exploit

Answer

access-list permit any

Answer

nat dynamic

Question 3

During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?

Accepted Answer

switchport access vlan 99. The 'switchport access vlan [id]' command is the standard way to assign a switch port to a specific VLAN.

Answer

shutdown vlan 99

Answer

vlan isolation enable

Answer

switchport trunk vlan 99

Question 4

An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?

Accepted Answer

ip arp inspection validate src-mac. Dynamic ARP Inspection (DAI) relies on DHCP snooping to validate ARP packets, preventing MAC spoofing.

Answer

snmp-server enable

Answer

ip access-group

Answer

switchport port-security

Question 5

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

Accepted Answer

IN_BYTES. The 'BYTES' or 'IN_BYTES' field in NetFlow records tracks the total octets transferred during the flow, critical for identifying large data transfers.

Answer

PROTOCOL

Answer

IPV4_SRC_ADDR

Answer

LAST_SWITCHED

Question 6

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

Accepted Answer

Unusually long, high-entropy subdomains. DNS tunneling often uses non-standard, long, or high-entropy subdomains to encode data.

Answer

High volume of A records

Answer

Requests for PTR records

Answer

Queries to root hints

Question 7

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

Accepted Answer

Source IP Address. Source IP address is the common attribute between a Windows logon log and a network flow record.

Answer

Target Username

Answer

Process Name

Answer

Event Correlation ID

Question 8

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Accepted Answer

tcp.port == 3389 && ip.src == 192.168.1.50. Filtering by protocol and source IP is essential to isolate traffic. tcp.port == 3389 isolates RDP, while ip.src filters the origin.

Answer

tcp.flags.syn == 1 && ip.src == 192.168.1.50

Answer

data.data == 3389

Answer

rdp.data && ip.dst == 192.168.1.50

Question 9

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Accepted Answer

tcpdump -i eth0 port 443 -w capture.pcap. The -w flag is used in tcpdump to write raw packets to a .pcap file.

Answer

tcpdump -c eth0 port 443

Answer

tcpdump -i eth0 port 443 > capture.txt

Answer

tcpdump -r capture.pcap port 443

Question 10

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

Accepted Answer

Whitelisting source IPs that can access the jump server. Restricting access to the jump server to only known source IPs significantly reduces the risk of unauthorized access.

Answer

Enabling telnet for administrative flexibility

Answer

Disabling all logging to save space

Answer

Assigning the jump server a public IP address

Question 11

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

Accepted Answer

Microsoft-Windows-PowerShell/Operational. Microsoft-Windows-PowerShell/Operational (Event ID 4104) logs the actual script block execution, which is vital for detecting malicious PowerShell commands.

Answer

Application Log

Answer

Security Log

Answer

System Log

Question 12

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

Accepted Answer

NTLMSSP_AUTH. NTLM authentication exchanges often show up in SMBv1 or SMBv2/3 negotiate/session setup requests, specifically looking for NTLMSSP structures.

Answer

SMB_COM_OPEN

Answer

NTLMSSP_NEGOTIATE

Answer

SMB_COM_TREE_CONNECT

Question 13

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Accepted Answer

Implement ACLs to block TCP 445 between segments. Blocking TCP 445 (SMB) at the boundary between network segments is the most effective way to stop worm-like lateral movement.

Answer

Disable DNS resolution on the host

Answer

Enable DHCP snooping

Answer

Flush the ARP cache

Question 14

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

Accepted Answer

Consistent interval between connections. Beaconing is characterized by consistent timing intervals between connections to a specific C2 server.

Answer

High-speed connection speed

Answer

Use of HTTPS

Answer

Randomized packet size

Question 15

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Accepted Answer

local0. Syslog facilities like 'auth' or 'local0' are commonly used to tag security-related logs on network devices.

Answer

kernel

Answer

cron

Answer

mail