212-89 Network Incidents — Timed 20 Questions

Question 1

When analyzing logs from a Palo Alto Networks firewall, which specific threat log field is most useful for identifying the 'User-Agent' string used by a beaconing malware to blend in with legitimate web traffic?

20 minute time limit — choose an answer to begin.

Accepted Answer

http-user-agent. In Palo Alto threat logs, the application-specific details or specific threat-id logs often contain the HTTP headers including the User-Agent.

Answer

rule-name

Answer

action

Answer

source-ip

Question 2

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

Accepted Answer

IN_BYTES. IN_BYTES in a NetFlow v9 record counts the total number of bytes observed in the flow, making it the direct measure of data volume transferred between hosts. For exfiltration analysis, comparing IN_BYTES across flows to external or unusual destinations reveals how much data left the network. It is the primary field for volumetric analysis in flow-based forensics.

Answer

PROTOCOL

Answer

IPV4_SRC_ADDR

Answer

LAST_SWITCHED

Question 3

You are configuring a Cisco ASA firewall to perform deep packet inspection to mitigate lateral movement via SMB exploits. Which feature must be enabled in the modular policy framework to drop packets containing known exploit patterns?

Accepted Answer

inspect smb. The Cisco ASA uses the 'inspect smb' command within a policy-map to trigger the inspection engine for SMB protocols.

Answer

filter smb-exploit

Answer

access-list permit any

Answer

nat dynamic

Question 4

During a network incident, you need to isolate a compromised workstation by updating the switch port configuration. Which command would you use on a Cisco Catalyst switch to move a port to a restricted VLAN?

Accepted Answer

switchport access vlan 99. The 'switchport access vlan [id]' command is the standard way to assign a switch port to a specific VLAN.

Answer

shutdown vlan 99

Answer

vlan isolation enable

Answer

switchport trunk vlan 99

Question 5

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

Accepted Answer

NTLMSSP_AUTH. Pass-the-Hash attacks authenticate using a stolen NTLM hash without knowing the plaintext password. In the NTLMSSP exchange, the NTLMSSP_AUTH message contains the NTLM response (the hash-based challenge response) that the server validates. Detecting this message type in SMB traffic is key because it carries the actual authentication attempt using the hash.

Answer

SMB_COM_OPEN

Answer

NTLMSSP_NEGOTIATE

Answer

SMB_COM_TREE_CONNECT

Question 6

An attacker uses 'ARP Spoofing' to perform a Man-in-the-Middle attack. Which command on a Cisco switch would prevent this by mapping MAC addresses to specific ports?

Accepted Answer

ip arp inspection validate src-mac. Dynamic ARP Inspection (DAI) relies on DHCP snooping to validate ARP packets, preventing MAC spoofing.

Answer

snmp-server enable

Answer

ip access-group

Answer

switchport port-security

Question 7

Which TWO of the following indicators are primary artifacts to look for when investigating potential lateral movement on a Windows network?

Accepted Answer

Event ID 7045 (Service Installation). Service installation and login events (4624/4625) are primary methods for lateral movement.

Answer

Event ID 1000 (Application Error)

Answer

Event ID 4688 (Process Creation)

Answer

Event ID 1102 (Log Cleared)

Question 8

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Accepted Answer

Masquerading malicious traffic on common ports like 443. Option A is correct because masquerading malicious traffic on common ports like 443 (HTTPS) allows the attacker's command-and-control or lateral movement traffic to blend in with legitimate encrypted web traffic, making it difficult for network monitoring tools to distinguish it from normal activity. Option E is correct because embedding data within encrypted SSH tunnels hides the actual payload from deep packet inspection, since the traffic appears as a legitimate SSH session on port 22, effectively concealing lateral movement. Option B is not correct because clear-text Telnet is easily detected by network monitoring and is not a stealthy technique for hiding traffic. Option C is not correct because sending traffic exclusively during business hours may reduce suspicion but does not inherently hide the traffic from detection systems. Option D is not correct because disabling logging on the source host is a host-based anti-forensic technique, not a network traffic-hiding technique for lateral movement.

Answer

Using clear-text Telnet for all communication

Answer

Sending traffic exclusively during business hours

Answer

Disabling all logging on the source host

Question 9

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

Accepted Answer

Verify if the IDS has visibility into the decrypted traffic. SSH brute force signatures often require the IDS to perform protocol decoding; if the traffic is encrypted and the IDS lacks the session keys, it can only see the handshake.

Answer

Check if the disk is full

Answer

Reboot the IDS appliance

Answer

Ensure NTP is synchronized

Question 10

An incident responder is investigating a suspected data exfiltration over HTTPS. The organization uses a next-generation firewall with TLS inspection enabled. Which artifact from the firewall logs would best help identify the exfiltration channel?

Accepted Answer

The TLS certificate issuer and common name of the external server. When TLS inspection is enabled, the firewall can decrypt and log detailed information about HTTPS sessions, including the server certificate. The certificate issuer and common name can reveal if the external server is legitimate or suspicious, such as a self-signed certificate or a known malicious domain. This is more specific than generic IP/port or byte counts, and directly aids in identifying the exfiltration channel.

Answer

The HTTP User-Agent string used by the internal host

Answer

The total number of bytes transferred during the session

Answer

The source IP address and port number of the internal host

Question 11

A security analyst is reviewing network traffic and observes a large number of TCP RST packets being sent from an internal server to various external IP addresses. The server is not responding to any SYN packets. Which type of network incident is most likely occurring?

Accepted Answer

TCP reset attack to disrupt communications. The internal server is sending TCP RST packets to various external IP addresses and is not responding to SYN packets. This behavior is indicative of a TCP reset attack, where an attacker uses a compromised host to send spoofed RST packets to disrupt legitimate TCP sessions. The incident handler should investigate the server for compromise and analyze the RST packets for spoofed source addresses.

Answer

TCP RST flood denial-of-service attack

Answer

TCP SYN scan with RST responses

Answer

TCP SYN flood denial-of-service attack

Question 12

A healthcare organization's incident response team detects a workstation repeatedly connecting to an external IP on TCP port 4444. The endpoint's EDR shows a process named 'svchost.exe' with a parent process of 'explorer.exe' and no digital signature. The network team captures traffic and sees a persistent outbound session with periodic small data transfers. Which network-based containment action should the responder take FIRST to disrupt the command-and-control channel while preserving evidence?

Accepted Answer

Apply a firewall rule to block the specific external IP and port 4444.. The priority is to sever the active command-and-control channel while preserving evidence. Blocking the specific external IP and port at the firewall disrupts the adversary's communication without altering the endpoint, allowing the responder to continue monitoring and collect network evidence. This targeted network containment is reversible and does not tip off the attacker, unlike disabling the port or rebooting.

Answer

Run a full antivirus scan on the workstation to remove the malware.

Answer

Immediately disable the switch port where the workstation is connected.

Answer

Reboot the workstation to terminate the malicious process.

Question 13

You are reviewing a PCAP from a suspected network incident and notice TCP segments where the sequence numbers do not increment across multiple consecutive packets, yet the payload sizes vary. Which network anomaly does this most accurately indicate?

Accepted Answer

TCP session splicing. TCP session splicing manipulates the TCP stream by sending packets with identical sequence numbers but different payloads, causing the receiver to reassemble data in an unexpected order. This technique is used to evade network-based detection systems that assume monotonically increasing sequence numbers. The static sequence numbers with varying payload sizes in the PCAP are a direct indicator of this evasion tactic, making it the most accurate anomaly among the choices.

Answer

TCP sequence number prediction attack

Answer

TCP session hijacking

Answer

TCP retransmission storm

Question 14

During an investigation of a suspected data exfiltration, an incident responder analyzes a packet capture and observes a series of TCP packets with the PSH flag set and small payload sizes (less than 100 bytes) sent from an internal server to an external IP over port 443. The payloads appear to be encrypted and are sent at regular intervals every 30 seconds. Which of the following BEST characterizes this traffic?

Accepted Answer

A command-and-control beacon using HTTPS.. The periodic small encrypted payloads to an external IP on port 443 are characteristic of malware beaconing over HTTPS. The regular 30-second interval indicates automated check-ins, and the small size suggests command-and-control or data exfiltration. This pattern is a strong network indicator of compromise, unlike normal update traffic or DoS attacks.

Answer

A covert channel using TCP PSH flag to transmit data.

Answer

A denial-of-service attack using TCP SYN flood.

Answer

A legitimate software update check.

Question 15

A company's security team is responding to a network incident where an attacker has compromised a workstation and is attempting lateral movement. The team needs to identify potential lateral movement techniques. Which TWO of the following are common lateral movement techniques used by attackers in a Windows environment? (Choose two.)

Accepted Answer

Pass-the-Hash. The correct answers are Pass-the-Hash and RDP hijacking. Pass-the-Hash allows attackers to authenticate to remote systems using captured NTLM hashes, facilitating lateral movement. RDP hijacking lets attackers take over existing RDP sessions to move to other machines. Both are well-documented lateral movement techniques in Windows environments and should be monitored for during incident response.

Answer

Cross-site scripting (XSS)

Answer

Kerberoasting

Answer

SQL injection

Question 16

During a network incident, you observe that an internal host is sending a high volume of ICMP echo requests to various external IP addresses, each with a payload size of 1500 bytes. The responses are also large. Which type of network incident is most likely occurring?

Accepted Answer

ICMP tunneling for data exfiltration. The host is sending ICMP echo requests with an unusually large payload of 1500 bytes to multiple external IPs, and the responses are also large. Normal ICMP ping traffic uses small payloads. The large payload size indicates that data is being embedded in the ICMP packets, which is characteristic of ICMP tunneling for data exfiltration. Incident handlers should capture and analyze the payload to confirm the exfiltration.

Answer

ICMP flood denial-of-service attack

Answer

Network reconnaissance via ICMP ping sweep

Answer

Smurf attack amplification

Question 17

A security analyst notices a large number of outbound DNS queries from a single internal host to various domain names that appear to be randomly generated, such as 'a1b2c3d4e5.com'. The queries are for A records and occur at a high rate. The analyst suspects a domain generation algorithm (DGA) used by malware. Which network-based containment action should be taken to disrupt this activity?

Accepted Answer

Configure the internal DNS server to sinkhole the suspicious domains.. Sinkholing the suspicious domains on the internal DNS server is a targeted containment that disrupts the DGA-based communication while allowing legitimate DNS queries. It prevents the malware from resolving its C2 domains and can help identify other infected hosts. Blocking all DNS or all traffic is too disruptive and not necessary.

Answer

Block outbound DNS queries from the internal host at the firewall.

Answer

Disable the DNS service on the internal host.

Answer

Apply a firewall rule to block all outbound traffic from the internal host.

Question 18

An incident responder is analyzing a network capture and needs to identify the protocol used for a denial-of-service attack that floods a target with SYN packets from spoofed source IP addresses. Which tool is specifically designed to detect this type of attack by monitoring half-open connections?

Accepted Answer

Snort with the 'flow:to_server,established' option. A SYN flood creates many half-open connections, which are best detected by a stateful intrusion detection system like Snort. The 'flow:to_server,established' option enables Snort to track TCP sessions and alert when there is an excessive number of SYN packets without corresponding ACKs. Other tools either lack stateful tracking or are not designed for real-time detection of this specific attack.

Answer

Snort with the 'flow:stateless' option

Answer

NetFlow analyzer monitoring TCP flags

Answer

tcpdump with a filter for 'tcp[tcpflags] & tcp-syn != 0'

Question 19

An incident responder is investigating a suspected network intrusion and observes a series of TCP packets with the RST flag set coming from an external IP to various internal hosts on different ports. The packets are not part of any established connection. What is the MOST likely explanation for this traffic?

Accepted Answer

A denial-of-service attack attempting to reset connections.. The unsolicited RST packets from an external IP to multiple internal hosts on different ports indicate a deliberate attempt to reset TCP connections, causing a denial of service. This can disrupt legitimate communications and may be a smokescreen for other attacks. It is not a port scan or a simple firewall misconfiguration, as those would have different patterns.

Answer

A legitimate network device performing TCP reset for load balancing.

Answer

A misconfigured firewall sending RST packets.

Answer

A port scan using TCP RST packets.

Question 20

During a network incident, you suspect data exfiltration over HTTPS. You have full packet capture but cannot decrypt the traffic. Which network traffic characteristic is most reliable for identifying the exfiltration channel?

Accepted Answer

Outbound traffic volume significantly exceeding inbound traffic for a sustained period. When encryption prevents content inspection, traffic analysis becomes essential. A sustained outbound traffic volume that significantly exceeds inbound traffic is a strong indicator of data exfiltration, as the attacker is sending data out while receiving little in return. This asymmetry is observable in full packet captures by comparing byte counts per flow. Other characteristics like periodicity, port usage, or TLS extensions are less specific and can be present in benign traffic.

Answer

Use of non-standard ports for HTTPS traffic

Answer

Periodic outbound connections to a specific IP with consistent packet sizes

Answer

Presence of TLS heartbeat extensions in the ClientHello