200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Reverse shell

  Why this is correct

  A reverse shell is an outbound connection from the victim to an attacker-controlled listener, carrying interactive commands such as whoami, ls -la and cat /etc/passwd. The bidirectional stream to a remote IP matches this pattern rather than inbound exploitation.

• ✗

  DNS tunnelling

  Why it's wrong here

  DNS tunnelling carries data inside DNS queries and responses, typically to a resolver on port 53, so it cannot produce a bidirectional TCP stream containing shell commands. It is tempting because it also enables covert command-and-control, and would be correct if the PCAP showed long, encoded subdomain labels or TXT record abuse instead of interactive shell traffic.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection targets database queries through application input fields, not an interactive TCP shell. The observed commands — 'whoami', 'ls -la', 'cat /etc/passwd' — are operating-system reconnaissance typical of a reverse shell, so no SQL parser is involved. SQL injection would fit a scenario where crafted input manipulates a web application's database queries.

• ✗

  Man-in-the-middle attack

  Why it's wrong here

  A man-in-the-middle attack intercepts or relays existing traffic between two parties, so the PCAP would show a victim's session being proxied or altered, not a remote host issuing shell commands. It is tempting because MITM also involves a remote IP and bidirectional traffic, and would be correct if the analyst saw ARP spoofing or certificate substitution.

Go deeper

Related to this question