CCNA Network Intrusion Analysis Questions

MITRE ATT&CK maps tactics, techniques and procedures to documented real-world threat groups, satisfying the framework's purpose of describing adversary behaviour rather than isolated indicators. Each group entry links specific techniques to observed campaigns, enabling defenders to prioritise detections against actors actually targeting their sector.

DGA malware rapidly cycles through algorithmically generated domain names, most of which are unregistered, producing bursts of DNS queries answered with NXDOMAIN. This high-volume, high-failure pattern distinguishes DGA activity from normal resolution of legitimate, registered domains.

Anomalous outbound FTP transfers from a server that normally generates no such traffic indicate data being stolen to an external destination. This matches exfiltration, where attackers move collected data out of the environment over file-transfer protocols.

A closed port has no listener, so the target's TCP stack replies to the SYN with a RST packet, immediately refusing the connection. An open port would answer SYN-ACK instead. This RST-versus-SYN-ACK difference is exactly what lets a SYN scan distinguish open from closed ports.

The short-lived, low-packet-count connections to many hosts on TCP 445 in a compressed timeframe match worm-style SMB scanning, where malware enumerates targets looking for writable shares or vulnerable services before moving laterally. A benign file server or backup job would not touch over a thousand distinct hosts in five minutes, and the uniform port reinforces automated propagation rather than user-driven access.

Delivery is the phase where the adversary transmits the weaponised payload to the victim, satisfying the stem's requirement for an exploit reaching the target via email attachment or malicious link. It follows Weaponisation and precedes Exploitation, making it the precise Cyber Kill Chain stage described.

Interactive shell over TCP is a reverse shell.

A ping sweep sends ICMP echo requests to multiple IP addresses to identify which hosts are alive. The scenario describes rapid, identical ICMP echo requests to multiple internal hosts, which is characteristic of a ping sweep used for network reconnaissance before a more targeted attack.

Beaconing malware checks in with its command and control server on a fixed schedule, producing repeated connections to the same external IP at consistent intervals. This regularity, rather than payload content or port choice, is the defining signature analysts use to distinguish beaconing from normal traffic.

DGA-generated domains are contacted by infected hosts to receive instructions from attacker infrastructure, which is the Command and Control phase. The outbound HTTPS beaconing to algorithmically generated domains is the defining C2 characteristic, occurring after exploitation and installation but before actions on objectives.

Sending UDP datagrams to successive ports and receiving ICMP Port Unreachable replies for closed ones is the signature of a UDP scan, which maps open UDP services by their silence versus closed ports returning ICMP unreachable messages.

SMB authentication attempts from one host to many hosts indicate an attacker using harvested credentials to move between systems. This pattern is characteristic of lateral movement, distinguishing it from a single-target brute-force or credential-stuffing attack.

Exfiltration of compressed database dumps to an external IP constitutes the adversary achieving their goal, which defines Actions on Objectives. The earlier phases (delivery, exploitation, installation, command and control) are already complete; this transfer is the mission's payoff, not lateral movement or staging.

Acknowledgement numbers are used to confirm receipt of data. An attacker may spoof ACKs to keep the session alive or to acknowledge injected data, preventing the legitimate endpoint from detecting the anomaly. Manipulating both sequence and acknowledgement numbers is necessary to maintain the hijacked session.

DGA malware generates large volumes of pseudo-random domains, cycling through them via short TTLs to evade blocklists. Because each domain is algorithmically produced and rapidly rotated, it will not yet appear in threat intelligence feeds, matching the observed HTTPS beaconing pattern.

TCP segmentation overlap evasion exploits differences in how operating systems and IDS reassemble overlapping segments. By sending out-of-window ACKs and overlapping sequence numbers, the attacker tries to make the IDS reconstruct a benign payload while the target host reconstructs a malicious one, causing the IDS to miss the actual attack.

An ACK scan sends TCP segments with only the ACK flag set to target ports. Because no prior handshake exists, the target responds with RST regardless of whether the port is open or closed. The key value is that filtered ports often drop the ACK silently while unfiltered ports return RST, allowing the attacker to map firewall rule sets rather than open services.

Unsolicited ICMP echo replies with embedded URL-like data are a known covert channel for command delivery. The immediate SMB connection to an internal server on port 445 is consistent with the delivered command instructing the host to move laterally or access a share. Correlating the payload content with the follow-on SMB session gives a defensible intrusion narrative, so this conclusion matches the evidence best.

Tunnelling tools continuously encode and transmit data, producing far more queries to a single domain than legitimate resolution patterns. This sustained query volume to one domain satisfies the stem's requirement for a DNS tunnelling indicator.

C2 beacons often use periodic, small payloads to check in with the attacker. The PSH flag indicates data is being pushed, and the 30-second interval suggests a beaconing pattern. This is typical of malware communicating with a C2 server.

A sustained, uniform outbound flow over 30 minutes with uniform packet sizes and PSH on nearly every packet strongly suggests an automated tool pushing data out, not a human browsing or emailing. Exfiltration tools often chunk data into consistent sizes to optimize throughput. In intrusion analysis, this beaconing-like regularity is a key indicator of malicious data transfer rather than legitimate user traffic.

DGA-generated domains provide resilient command and control infrastructure, letting malware receive instructions and exfiltrate data despite takedown attempts. The HTTPS beaconing to algorithmically generated names is the defining C2 signature, directly satisfying the stem's requirement to identify the Cyber Kill Chain phase for this technique.

Pass-the-hash exploits NTLM's design, where the password hash itself authenticates without knowing the plaintext. Replaying a captured hash across multiple hosts via SMB produces exactly the observed pattern of lateral authentication attempts, distinguishing it from credential guessing or Kerberos abuse.

Beaconing malware contacts its command-and-control server on a fixed schedule, so traffic recurs at predictable intervals rather than randomly. This periodicity, often with consistent packet sizes, distinguishes automated beaconing from bursty human browsing and satisfies the stem's requirement for a typical C2 indicator.

Automated exfiltration tools typically beacon or upload on a schedule with consistent payload sizes, producing regular intervals and near-identical byte counts. Human browsing is irregular in both timing and volume. This periodicity and uniformity are strong behavioral indicators that a script or malware, not a person, is generating the traffic, making it a reliable discriminator in this scenario.

Delivery is the phase where the adversary transmits the weaponised payload — such as a malicious attachment or link — to the target. Exploitation occurs only after the user opens it, so transmission itself sits in Delivery.

Delivery is the phase where the adversary transmits the weaponised payload to the victim, such as a malicious attachment sent by email. Exploitation occurs only after the user opens it, so delivery is the correct phase.

Large, consistently sized ICMP echo requests with payloads that change on every packet indicate data is being carried inside the ICMP payload rather than standard reachability testing. Normal ping payloads are small and static, often a fixed pattern. The external host returning normal-sized replies fits a covert channel where the request carries the data outbound. This is a classic ICMP tunneling signature that warrants payload inspection and host isolation.

Pass-the-hash reuses captured NTLM password hashes directly for authentication, bypassing plaintext password knowledge entirely. The multiple SMB connections between internal hosts using hashes rather than credentials match this technique's signature, distinguishing it from credential cracking.

Legitimate ping payloads are usually fixed patterns such as alphabetic strings or zeros. When the payload varies on every request and contains high-entropy, non-printable bytes, it suggests data is being encoded into the ICMP data field for exfiltration. This is a classic indicator of an ICMP tunnel or covert channel, especially when combined with a consistent external destination.

Regular beaconing at fixed 60-second intervals to an external suspicious high-entropy domain over HTTPS indicates an implanted host checking in with its controller. This periodic callback traffic is the hallmark of the Command and Control phase of the Cyber Kill Chain.

Lateral movement tools such as PsExec and Cobalt Strike's SMB beacon rapidly authenticate to many hosts from one source. A single host initiating SMB sessions to numerous distinct hosts deviates from normal peer-to-peer patterns and indicates propagation.

Repeated, uniform, short-lived completed TCP sessions to the same external endpoint are characteristic of beaconing malware or an automated client polling a service on a timer. The consistent small transfer size and full handshake/teardown pattern distinguish it from scanning or flooding. The analyst should baseline the interval and correlate with process and destination reputation to confirm whether it is malicious command-and-control.

RDP gives an attacker an interactive graphical session on a remote host once valid credentials are obtained, enabling direct control of additional systems. That remote-access mechanism moves the intrusion sideways across the estate, matching the stem's lateral movement evidence.

A NOP sled preceding executable code is the signature of a buffer overflow exploit, where the sled provides a landing zone for the overwritten return address to jump into. The network signature detecting shellcode in the payload confirms this exploitation technique.

Sending SYN packets to multiple ports and interpreting RST replies for closed ports is the defining behaviour of a half-open SYN scan, which never completes the handshake. This matches the packet pattern in the stem, distinguishing it from a full-connect scan that completes the three-way handshake.

DNS tunneling uses DNS queries to exfiltrate data.

Alternating small payloads, long duration, and steady delays are hallmarks of an interactive remote shell or beacon where each request and response carries a short command or result. A reverse shell keeps the session alive for hours, and the ten-second cadence reflects either human interaction or a beacon interval. The non-TLS payload on port 443 confirms deliberate port masquerading to blend with expected HTTPS traffic.

FTP 530 responses indicate failed logins. A high frequency of these within a short period strongly suggests automated brute-force attempts, as legitimate users rarely fail repeatedly in rapid succession. This is a key indicator of brute-force activity.

A reverse shell is an outbound connection from the victim to an attacker-controlled listener, carrying interactive commands such as whoami, ls -la and cat /etc/passwd. The bidirectional stream to a remote IP matches this pattern rather than inbound exploitation.

Wireshark's Export Objects feature reconstructs files carried over protocols such as HTTP, SMB and TFTP from captured packets and writes them to disk. This directly satisfies the requirement to extract files from a PCAP for further analysis, unlike tools that only inspect headers or statistics.

Repeated inbound connections to TCP 445 across multiple hosts, followed by SMB negotiation, indicate an external actor probing or attacking SMB services. Port 445 is used by SMB for file sharing and is a common target for enumeration and exploitation. The breadth of targets suggests scanning or worm-like behavior rather than a single targeted connection.

High-entropy subdomains carrying small queries at fixed 60-second intervals indicate data encoded into DNS labels and exfiltrated or commanded through recursive resolvers. The absence from blocklists and regular beaconing fit DNS tunnelling used for command-and-control rather than normal resolution.

A false positive occurs when detection logic flags activity that is actually benign, so a confirmed benign file triggering a known-malware signature matches this classification. The alert fired correctly per the signature, but the underlying file is harmless, distinguishing it from a true positive.

A SYN scan sends a lone SYN packet to probe a port; a closed port replies with RST, and no handshake completes. This matches the stem's single SYN to a closed port, satisfying the constraint that the connection never finished the TCP three-way handshake.

A large outbound HTTP POST to an untrusted external address, with a response that does not match normal application behaviour, indicates data being uploaded out of the network. Exfiltration over HTTP commonly abuses permitted web traffic to move stolen data past egress controls.

An ICMP port unreachable response means the target host received the UDP datagram but no application is listening on that port, which is the definitive indicator that the scanned port is closed rather than filtered.