CCNA Network Intrusion Analysis Questions

HTTPS to a suspicious domain is common C2.

Sustained, consistent outbound flows to the same external IP over an extended period suggest an automated transfer of data. Combined with large volumes during off-hours, this pattern supports exfiltration rather than normal user activity. Analyzing flow duration and consistency helps distinguish a deliberate data transfer from sporadic or interactive traffic.

DNS tunnelling encodes stolen data into subdomain labels, so queries carrying long, high-entropy subdomain strings that exceed normal hostname lengths are a hallmark indicator. This satisfies the stem's requirement for a common exfiltration indicator, since legitimate DNS lookups rarely use such extended labels.

An ACK scan sends packets with only the ACK flag set to map firewall rule sets and determine whether ports are filtered or unfiltered. Because the target responds with RST to both open and closed ports, the scanner learns filtering behavior rather than port state. The absence of a preceding SYN and the flood of ACK segments to a closed port match this technique exactly.

Tracking distinct usernames alongside failed authentication response codes per source IP reveals whether the source is spraying many accounts or hammering one, and the rate over time distinguishes brute force from occasional user error. This directly characterizes the campaign's scope and supports blocking or rate-limiting decisions. It is the core evidence that confirms the activity is systematic rather than incidental.

The UNION SELECT payload is injected directly into the id parameter, attempting to append rows from the users table to the query result. This satisfies the SQL injection indicator, unlike plain numeric values or encoded characters that carry no SQL syntax.

Relays authentication to other hosts.

The traversal attempt is a strong indicator, but the HTTP 200 alone does not establish success. Reviewing whether the response body contained file contents, and checking web server or file system access logs for reads of sensitive paths, determines whether the attack actually worked. This evidence-driven step correctly separates an attempt from a confirmed breach and guides containment decisions.

tcp.stream isolates one complete TCP conversation by its stream index, letting you follow and export all payload bytes for that specific session. This satisfies the requirement to extract the full TCP data of a single conversation rather than filtering individual packets by port or address.

Pass-the-hash lateral movement produces a fan-out pattern: one compromised host authenticating via SMB to many targets in quick succession. This satisfies the stem's requirement for a typical indicator, since legitimate users rarely generate such broad single-source SMB authentication bursts.

A SYN scan probes ports by sending SYN packets; receiving SYN-ACK proves the port is open, and the scanner immediately sends RST to tear down the half-open connection rather than completing the handshake. That SYN-then-RST pattern distinguishes it from a full connect scan.

The tcp.stream eq 0 filter isolates a single reassembled TCP conversation by its stream index, letting the analyst follow the full exchange between the two hosts. Following the stream reconstructs the session payload for forensic review.

An interactive shell where the remote host executes commands such as whoami and ls indicates the attacker's machine is receiving a session from the victim, the defining pattern of a reverse shell. The victim initiated the outbound connection, evading inbound firewall rules.

Long, random-looking subdomains encode exfiltrated data or command payloads, since DNS labels carry limited bytes per query. Repeated queries to one domain, rather than many domains, match tunnelling's need for a stable server endpoint. This pattern satisfies the stem's requirement for a characteristic distinguishing tunnelling from ordinary DNS resolution.

The 'UNION SELECT' string in URI parameters is a classic SQL injection signature, used to append attacker-controlled queries onto a legitimate database statement. Its presence across multiple HTTP requests confirms attempts to manipulate backend SQL through unsanitised input.

The server sends FIN+ACK to start a graceful close, meaning it has no more data to send. The client, however, continues to transmit data, which is a violation of TCP half-close semantics. Eventually, the client sends an RST, abruptly terminating the connection. This could indicate a malfunctioning client or an attempt to disrupt the session.

A TCP connect scan completes the full three-way handshake for each port and then immediately sends an RST to tear down the connection. This matches the observed SYN, SYN-ACK, ACK, and RST sequence. It is used when the scanner does not have raw packet privileges and relies on the OS connect() call.

Using ip.addr twice with the AND operator matches packets where either field equals the first address and either field equals the second, effectively isolating bidirectional traffic between the two hosts. This is the standard way to view a conversation regardless of direction, which is exactly what the analyst needs when the role of client and server may vary during the exchange.

A 500 MB outbound FTP transfer at 2:00 AM, vastly exceeding the workstation's normal 10 MB daily volume, indicates bulk data leaving the network. This anomalous volume and timing point to data exfiltration rather than routine activity or a benign transfer.

ICMP tunneling hides data inside echo request and reply payloads, allowing covert communication through firewalls that permit ping. Non-default payload sizes and changing encoded bytes in replies are strong indicators that data is being exchanged, not just reachability tested. This matches the pattern of an ICMP-based covert channel.

A false positive is an alert that fires without any genuine malicious activity, exactly matching the scenario where triage confirms no attack occurred. The classification axis here is whether the detected event reflects real threat activity: benign or expected behaviour triggering detection logic is a false positive, distinct from a true positive.

FTP transfers of internal document names to an external IP indicate unauthorised data movement off the network. The high outbound volume, external destination and sensitive file naming together satisfy the exfiltration pattern rather than normal FTP use or scanning.

A fixed 60-second interval, random-looking identifiers in the User-Agent and URI, and a large response body despite a 404 status are classic HTTP beaconing with covert channel encoding. Legitimate clients do not send random hex in these fields, and a true 404 would not carry kilobytes of meaningful content. The implant is polling for instructions and receiving tasking data disguised as an error page.

Legitimate ARP is request-driven, so a flood of unsolicited ARP replies, especially gratuitous ones claiming an IP already in use, indicates an attacker updating victims' caches. This behavior is characteristic of ARP poisoning tools that continuously send forged replies. Detecting a high rate of unsolicited replies is a reliable network-level indicator.

The signature correctly matched genuine XSS payload characters in the URI, and inspection confirms an actual attack attempt rather than benign traffic. A true positive means the IDS alerted on real malicious activity, satisfying the stem's requirement for accurate classification of the confirmed script injection.

Short-lived connections to TCP port 3389 across many internal hosts in rapid succession match a scan probing for reachable RDP services. Scanners often open and close sessions quickly to test responsiveness rather than complete authentication. The fan-out to multiple hosts from one external source reinforces scanning behavior, so this pattern indicates reconnaissance against RDP endpoints rather than any legitimate administrative session.

Because recursive resolver query logs are already forwarded to the SIEM, searching for the workstation's source IP paired with the suspicious domain directly confirms whether the host issued that lookup and when. This is the most direct and authoritative evidence of resolution attempts. It also establishes a timeline anchor that the analyst can use to pivot to proxy, firewall, and endpoint data for corroboration.

In ARP poisoning, an attacker sends gratuitous ARP replies to associate their MAC address with multiple IP addresses, or to impersonate the gateway. Seeing a single MAC address claiming ownership of several IPs is a strong indicator. Legitimate hosts typically have one IP per MAC address (or a few in specific configurations), so this behavior is suspicious.

A single source sending hundreds of requests per second to many different URL paths with an identical User-Agent is characteristic of automated content discovery or directory brute-forcing tools. These tools enumerate paths to find hidden files or administrative interfaces. The high rate and fixed User-Agent distinguish it from normal user browsing or legitimate crawling.

SYN packets followed by RST responses, with no completed handshake, indicate a port scan probing which ports are open or closed. This information-gathering activity against the target host characterises the Reconnaissance phase of the Cyber Kill Chain.

Long, random subdomains indicate DNS tunnelling, where malware encodes stolen data or instructions within query names to bypass perimeter controls. This satisfies the C2 detection requirement because the victim resolves high-entropy domains belonging to an attacker-controlled authoritative nameserver, revealing beaconing traffic that standard domain reputation filtering would miss.

Encoding data into DNS query names and pushing it to an authoritative server via high-volume lookups is DNS tunnelling. The base64 subdomains and abnormal query volume from one host match covert channel exfiltration rather than normal resolution traffic.

A TCP Xmas scan sets the FIN, PSH, and URG flags simultaneously, which makes the packet look 'lit up like a Christmas tree.' Because these flag combinations are invalid in normal TCP communication, closed ports respond with RST while open ports silently drop the packet, allowing the attacker to infer port state without completing a handshake.

Nmap's UDP scan sends zero-byte UDP datagrams to target ports; closed ports return ICMP port unreachable, matching the capture. The rule signature and traffic genuinely reflect scanning activity, so the analyst classifies it as a true positive rather than a false positive.

Pass-the-hash reuses a captured NTLM hash to authenticate without cracking the plaintext password, so the identical hash parameter across all three SMB sessions matches the stem's constraint exactly. The single internal source host fanning out to multiple targets within seconds is characteristic of automated lateral movement using stolen credentials.

ROP gadgets are short instruction sequences ending in a return, chained to bypass DEP by reusing existing executable code. Their appearance in the payload is a specific exploitation indicator, matching the attack described in the stem.

A UDP scan sends packets to many UDP ports; closed ports return ICMP port unreachable messages, exactly matching the observed responses. This distinguishes it from TCP-based scans, which rely on SYN, ACK or RST behaviour rather than ICMP errors.

A FIN scan sends TCP packets with only the FIN flag set to various ports. Closed ports respond with RST, while open ports ignore the packet. The pattern of FIN packets without ACK followed by RST responses is characteristic of a FIN scan, a stealthy scanning technique.

Repeated SMB authentications from one host to many hosts with varying usernames indicate an attacker pivoting across the network after initial compromise, using harvested credentials to access further systems. This credential-spraying pattern across multiple targets is the hallmark of lateral movement rather than external scanning or exfiltration.

FTP exfiltration matches the large outbound transfers of .zip files, since FTP carries bulk file data over dedicated control and data channels. This satisfies the stem's second observation directly, distinguishing it from DNS tunnelling and HTTP POST encoding, which handle covert or encoded channels rather than straightforward bulk archive transfer.

SYN scanning across multiple ports with RST replies for closed ports and silence for open ones is active port probing, gathering information about live services before exploitation. This maps to Reconnaissance, the first Cyber Kill Chain phase, where adversaries enumerate the target's attack surface.

Using TCP port 53 with non-DNS binary payloads while also connecting to TCP port 4444 is a classic masquerading technique: the attacker picks a port commonly allowed through firewalls and tunnels a custom C2 protocol over it. The absence of DNS query/response formatting and the paired 4444 connection confirm a custom C2 channel, not legitimate DNS. This matches real-world malware that abuses trusted ports to evade egress filtering.

ICMP echo requests to a range of subnet addresses are a classic host discovery method. Hosts that respond with echo replies are confirmed alive, while non-responders are either offline or blocking ICMP. This technique avoids establishing any TCP connections, which matches the analyst's requirement to identify active hosts without TCP sessions. It is commonly used by tools such as nmap with the ping sweep option.

Bidirectional small packets with command echo patterns reveal an interactive shell: each keystroke travels to the attacker, the command output returns, and the shell echoes input back. This request-response rhythm, with tiny payloads and echoed characters, satisfies the stem's requirement for identifying live human interaction rather than bulk data transfer.

When a hostname resolves to an IP inconsistent with the DHCP lease and SMB traffic then reaches an attacker server, the name resolution itself has been manipulated. DNS spoofing or rogue responses inject false A records so clients connect to the attacker. This directly accounts for the mismatched resolution and the redirected SMB sessions, making it the best explanation for the observed behavior.

Extracting a PE executable from the PCAP shows the malicious file being transferred to the target host, which is the Delivery phase of the Cyber Kill Chain. Delivery covers transmission of the weaponised payload via email, web, or USB, satisfying the scenario's file-transfer constraint.

When SQL injection is attempted, malformed queries can cause the database to return error messages. These errors, such as syntax errors or unclosed quotation marks, often appear in HTTP responses and reveal that the input affected the SQL query, confirming an injection attempt.

Regular, small, consistent beaconing to an external domain indicates an implanted host checking in with its controller. That recurring channel is the Command and Control phase, where the adversary maintains remote direction of compromised systems after exploitation.

Large, fixed-size ICMP payloads with repeating patterns and matching replies indicate data being encapsulated inside ICMP Echo packets. Normal ping payloads are small (often 32-64 bytes) and random. The consistent size and pattern suggest a covert channel using ICMP tunneling tools like ptunnel or icmpsh to exfiltrate or communicate stealthily.

Because many IDS engines and applications ignore or mishandle the URG flag and urgent pointer, attackers can abuse them as a side channel or to desynchronize inspection. Setting URG with a meaningless urgent pointer while still delivering normal data lets the attacker signal a cooperating peer or confuse the IDS without disrupting the actual TCP stream.

Attackers frequently abuse HTTP headers such as User-Agent and Cookie to blend C2 traffic with normal web activity. Random alphanumeric User-Agent values and base64-encoded Cookie data indicate obfuscated payloads, while small 200 OK responses represent tasking or acknowledgements. This pattern matches HTTP-based C2 with exfiltration embedded in request headers rather than the body.

The URI parameter `%27%20UNION%20SELECT%201,2,3%20--` is URL-encoded, where `%27` decodes to a single quote (`'`), `%20` to a space, and `--` to an SQL comment. This payload injects a single quote to break out of a string context, then appends a `UNION SELECT` statement to retrieve arbitrary data, with the comment `--` suppressing the remainder of the original query. This directly satisfies the constraint of manipulating SQL syntax via user-supplied input, confirming SQL injection.

ICMP tunneling for exfiltration often embeds encoded data in the payload, such as base64 strings, which are not present in normal ping requests. The varying length and non-standard content indicate that the ICMP echo requests are carrying hidden data rather than simply testing connectivity. This is a strong indicator of exfiltration or covert channel use.

The payload 'id=1 OR 1=1' is a classic tautology injection attempt, but the server returned a normal page with no compromise indicators. Because the attack neither succeeded nor altered behaviour, the alert reflects benign traffic rather than a genuine intrusion, so it is classified as a false positive.

ICMP tunneling embeds data inside echo request and reply payloads, which is exactly what the oversized, encoded, non-standard payloads indicate. The asymmetry in payload size and the presence of encoded fragments suggest a tool using ICMP as a transport to move data out of the network. This technique bypasses controls that allow ping but do not inspect ICMP payload content.

A TCP SYN stealth scan sends a SYN, receives a SYN-ACK if the port is open, but then sends a RST to tear down the connection before it is fully established. This half-open scanning technique avoids completing the handshake, making it stealthier and matching the described pattern of SYN, SYN-ACK, then RST.

The string UNION SELECT combines result sets from separate queries, a hallmark of SQL injection, where attackers append crafted SQL to input fields. Detecting it in a URI parameter indicates an attempt to manipulate the backend database query, satisfying the intrusion signature described.

The payload contains a UNION SELECT statement appended to a query, the classic signature of SQL injection, where an attacker concatenates a crafted query to extract data such as usernames and passwords. The HTTP POST parameter carrying this syntax confirms database query manipulation rather than cross-site scripting or command injection.

Small, regular packets with the PSH flag set often indicate interactive traffic where data is sent immediately. This pattern is typical of command-and-control (C2) communications, where an attacker sends commands and receives output in small chunks, maintaining a persistent session with periodic check-ins.

Regular 60-second beaconing with consistent payload size to an external IP indicates an implanted host checking in with its controller. This periodic, uniform outbound pattern is characteristic of the Command and Control phase, where compromised systems receive instructions and exfiltrate data.

Scanning tools randomize source ports and vary window size and other header fields to evade simple signature matching and to avoid exhausting local ephemeral ports. Combined with the absence of completed handshakes, this header variation supports an automated scanner rather than a browser or API client, which would use one consistent source port per connection and a stable window size negotiated once per session.

The payload injects a UNION SELECT clause into the id parameter, appending a query that returns usernames and passwords. This is classic SQL injection: attacker-supplied SQL is concatenated into the backend query, letting the database return data it should not expose.

Heap spray describes shellcode placed repeatedly across heap memory to land at a predictable address during exploitation. The PDF object carries that sprayed payload, which is why the IDS signature names heap spray rather than a buffer overflow or denial-of-service technique.

Periodic outbound HTTPS traffic combined with rotating IP resolutions points to domain generation algorithms, where malware cycles through algorithmically generated domains for command-and-control. The regular interval satisfies the beaconing constraint, while the shifting IP addresses reflect DGA domains resolving to changing infrastructure, distinguishing it from static command-and-control.

ROP gadgets chained in a decoded payload indicate memory-corruption exploitation, where an attacker hijacks control flow to bypass DEP and execute code. The POST delivers the crafted chain, so the payload's purpose is exploitation rather than reconnaissance or exfiltration.

Normal ping payloads are typically small (e.g., 32 or 64 bytes) and often consist of a repeating pattern or timestamp. Large, varying payloads suggest that actual data is being carried inside the ICMP packets, which is the essence of ICMP tunneling. The consistent size and non-repetitive content further indicate a structured data transfer, supporting the conclusion of tunneling.

Pass-the-hash exploits the NTLM challenge-response protocol: the attacker captures the static NT hash and replays it directly, authenticating without ever cracking it to plaintext. This matches the stem's constraint of authentication using a hashed password rather than the cleartext credential.

ICMP tunneling encapsulates data within ICMP echo request and reply packets, often using large payloads with high entropy to hide exfiltration or command-and-control traffic. The scenario describes large, non-ASCII, high-entropy payloads in both directions, which is a classic indicator. Normal ping traffic uses small, predictable payloads, so the unusual size and content strongly suggest tunneling.

ICMP tunneling abuses the data field of Echo Request and Echo Reply packets to carry arbitrary payloads. The non-repeating binary content and command-like strings in the Echo Request payload, combined with empty Echo Replies, indicate the host is sending data or receiving instructions inside ICMP rather than performing normal reachability checks.

Exfiltration of database records to an external FTP endpoint fulfils the attacker's ultimate goal, so it maps to Actions on Objectives. Earlier phases cover reconnaissance, weaponisation, delivery, exploitation, installation and command-and-control; the actual theft of sensitive data is the final stage.

Repeated DNS queries carrying base64-encoded labels in subdomains indicate data encoded into DNS requests, a hallmark of DNS tunnelling used to exfiltrate data covertly through permitted DNS traffic, bypassing egress controls that block other channels.

The signature fired on a string resembling SQL injection, but investigation confirmed the application is not vulnerable and the traffic was a benign test. The alert therefore correctly identified suspicious syntax yet wrongly indicated an actual attack, which is a false positive.

`tcp.stream eq 0` isolates every packet belonging to stream index 0, letting Wireshark reassemble the full bidirectional conversation regardless of ports or IP addresses. This satisfies the stem's requirement to follow the entire TCP stream, since stream indexing groups related segments that Follow TCP Stream also relies on.

A reverse shell payload initiates the TCP connection from the compromised host back to the attacker, then carries an interactive command session. The irregular prompts and responses in the PCAP reflect that outbound, attacker-controlled shell rather than a legitimate client-server protocol.

The payload 'UNION SELECT username,password FROM users--' appends a second query to the original, harvesting credential columns and commenting out the remainder. This is textbook SQL injection, exploiting unsanitised input in the 'id' parameter to exfiltrate database contents.