200-201 Network Intrusion Analysis Practice Question
An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ROP gadgets
Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ROP gadgets
Why this is correct
ROP gadgets are short instruction sequences ending in a return, chained to bypass DEP by reusing existing executable code. Their appearance in the payload is a specific exploitation indicator, matching the attack described in the stem.
- ✗
NOP sled
Why it's wrong here
A NOP sled is a run of no-operation instructions that slides execution into shellcode, so it belongs to classic stack-overflow delivery rather than ROP, which reuses existing gadget addresses and needs no landing pad. It would be the indicator for a buffer-overflow payload.
- ✗
Heap spray
Why it's wrong here
Heap spray is a memory-layout technique that fills the heap with attacker-controlled data to make a jump target predictable, and it is not specific to ROP, which instead chains existing code fragments already present in loaded modules. It would be an indicator for use-after-free or type-confusion exploits.
- ✓
Shellcode
Why this is correct
Shellcode is the executable payload delivered after exploitation, containing position-independent machine code that performs the attacker's action, such as spawning a reverse shell. Its presence in the PCAP, alongside ROP gadget chains, directly satisfies the stem's requirement for exploitation indicators tied to this memory-corruption attack.
- ✗
DNS tunnelling
Why it's wrong here
DNS tunnelling exfiltrates data through DNS queries and responses; it is a command-and-control or data-transfer technique, not an indicator of ROP gadget and shellcode execution. It is tempting because DNS traffic commonly appears alongside exploitation in intrusion PCAPs, but it evidences exfiltration rather than memory-corruption exploitation.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.