CCNA Security Monitoring Questions

The domain name used in the communication is a classic Indicator of Compromise (IoC). When an internal host contacts an external IP known for malware distribution, the domain name (e.g., via DNS query) provides a persistent, human-readable identifier that can be used to block or investigate the threat, even if the IP address changes. This aligns with the NIST definition of IoCs as forensic evidence of a potential intrusion.

The 'ET POLICY Outgoing HTTP Request with Suspicious User-Agent' signature indicates a policy violation, not necessarily a confirmed attack. An analyst must first investigate the source IP and user-agent to determine if the traffic is malicious (e.g., command-and-control communication, data exfiltration) or benign (e.g., a legitimate application using a non-standard user-agent). Immediate blocking (Option A) could disrupt legitimate services, while ignoring the alert (Option D) risks missing a real threat.

A port scan involves sending packets to multiple ports on a target to discover open ports. The description matches a TCP SYN scan.

The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.

Port scanning involves multiple ports on multiple hosts from one source. Unique destination ports and unique destination IPs are key. Low packet count per connection is typical of scans (e.g., SYN scans).

Zeek's http.log contains detailed HTTP transaction information including methods, URIs, and status codes.

The repeated pattern of unique, seemingly random subdomains (e.g., 'a1b2c3.malicious.com') from a single internal host is a classic indicator of DNS tunneling. This technique encodes exfiltrated data into DNS query subdomains, leveraging the fact that DNS traffic is often allowed through firewalls. The malicious server decodes the subdomain strings to reconstruct the stolen data.

The rule 'alert tcp any any -> any 80' matches HTTP traffic, and 'content:"POST"' detects the method. The 'pcre' option can match the long User-Agent. The other options are incorrect because they don't specify port 80 or use wrong protocols.

System logs contain authentication events (success/failure) which are essential to detect repeated failed SSH logins. Firewall logs show source IPs and ports being accessed (SSH port 22), which can identify the attacking IP. IDS/IPS alerts might detect brute-force patterns but are not the primary source; DNS logs and web server logs are irrelevant to SSH brute-force.

HTTPS (HTTP Secure) uses port 443 for encrypted web traffic.

Setting a higher threshold (e.g., detection_filter) reduces alerts for low-frequency events. Enabling 'suppress' can ignore specific sources or destinations that generate false positives.

Port 445 is the default port for Microsoft's implementation of the Server Message Block (SMB) protocol, used for file and printer sharing over a network. An unusual amount of traffic on this port often indicates SMB-related activity, such as legitimate file transfers or potential exploitation attempts like the EternalBlue vulnerability (MS17-010).

SSH (port 22) is correct because it provides encrypted remote administration, making it a common target for brute-force attacks and unauthorized access attempts. RDP (port 3389) is correct because it is the primary protocol for remote GUI administration on Windows systems and is frequently exploited via credential stuffing or vulnerability scanning. Both protocols should be monitored for anomalous login patterns and unauthorized access.

To reduce false positives without losing detection capability, the analyst should create a suppression filter that excludes the known benign IP or application from triggering the signature.

An unusually large ICMP echo request packet, such as 65,000 bytes, exceeds the maximum allowed size for a standard ICMP packet (typically 65,535 bytes total including headers, but the data payload should not exceed 65,527 bytes). This oversized packet is a classic indicator of a 'Ping of Death' attack, where the attacker sends a malformed packet that causes a buffer overflow on the target system, leading to a crash or remote code execution. In Wireshark, such an anomaly stands out against normal ICMP traffic, which usually has a small payload (e.g., 32 or 56 bytes).

Repeated denied packets from a single source IP to a specific destination on port 22 (SSH) indicate a brute-force attack, where an attacker attempts multiple username/password combinations to gain unauthorized access. The firewall logs show the traffic is being blocked, but the pattern of repeated attempts is characteristic of an SSH brute-force attack, not a flood or exploit targeting other services.

Web server logs capture HTTP requests with details like URL, method, response code, and user-agent. They are the best source for HTTP traffic details.

NetFlow/IPFIX provides flow records with byte counts, enabling detection of unusual data volumes, even with encrypted payloads.

Privilege escalation often involves account creation with elevated rights, changes to user privileges, and successful use of 'sudo' commands.

Port 445 is used by SMB (Server Message Block) for file sharing and network communication. A high volume of denied outbound connections from a single workstation to many external IPs on this port is a classic indicator of malware attempting to propagate via SMB vulnerabilities, such as EternalBlue (MS17-010). Legitimate SMB traffic is typically confined to internal networks, not external scanning.

The Network layer (Layer 3) handles logical addressing (IP addresses) and routing. IP spoofing involves falsifying the source IP address at this layer.

Port 3389 is the default port for Remote Desktop Protocol (RDP), which is used for remote graphical desktop access to Windows systems. The firewall rule denying traffic from 10.0.0.5 to this port blocks RDP connections, preventing that host from initiating remote desktop sessions.

URLs are correct because they can indicate the destination of exfiltrated data, such as a cloud storage endpoint or a command-and-control server. File hashes (MD5/SHA-256) are correct because they uniquely identify the specific files being transferred, allowing the analyst to track known malicious or sensitive files across the network.

Normalization is the SIEM component that parses incoming log data from diverse sources (e.g., syslog, Windows Event Log, NetFlow) and maps the fields into a common, standardized schema. This process ensures that fields like source IP, destination IP, and timestamp are consistently named and formatted, enabling effective correlation and analysis across heterogeneous devices.

The log entry shows a successful HTTP 200 response to a POST request to a login page. While a single 200 is normal, it is the most suspicious observation among the options because it indicates a successful login, which could be part of a brute force or credential stuffing attack if many attempts preceded it. The correct answer is A.

A successful authentication event following multiple failed attempts is a key indicator of a brute-force or password-spraying attack. The analyst must correlate the failed attempts with the eventual success to identify that the attacker gained access after guessing or cracking the credentials.

A port scan uses TCP SYN packets to probe for open ports on a target host. Excessive SYN packets to multiple ports indicate a port scan.

The log entry shows 'action=deny', which explicitly indicates the firewall blocked the packet. Since destination port 22 is the default port for SSH, this log entry represents an attempted SSH connection from 192.168.1.100 to 10.0.0.1 that was denied by the firewall. The analyst's knowledge that 10.0.0.1 is an SSH server confirms the nature of the traffic.

SNMP traps are sent from agents to managers using UDP port 162. SNMP uses UDP, not TCP.

A horizontal port scan targets the same port across multiple destination IPs. In NetFlow, each connection attempt typically involves a low number of packets (often just a SYN) because the scanner does not complete the TCP handshake. This pattern of low packet counts per flow is a strong indicator of scanning activity.

'MZ' indicates a PE (Portable Executable) file, and 'CreateRemoteThread' is a common API used for process injection, suggesting malware.

The Network layer (Layer 3) is responsible for logical addressing (e.g., IPv4/IPv6 addresses) and routing decisions that determine the best path for data packets across interconnected networks. Protocols such as OSPF, BGP, and ICMP operate at this layer to manage routing tables and forward packets between different subnets or autonomous systems.

SIEM aggregates logs from various sources and applies correlation rules to detect threats. Packet capture and port scanning are not core SIEM functions.

A brute-force attack involves repeated login attempts using many password guesses against a single account or a set of accounts. The SIEM rule correlates more than 10 failed login attempts from the same source IP within 1 minute, which is a classic signature of an automated password-guessing tool. This threshold-based detection is specifically designed to identify brute-force activity, not other attack types.

Multiple failed logins from the same source IP in a short time indicates a brute force attack.

Zeek generates application-layer logs by parsing protocol-specific traffic. SMTP (Simple Mail Transfer Protocol) is an application-layer protocol, and Zeek's smtp.log captures email transactions, including sender, recipient, and message IDs, providing visibility into email-based activity.

Lateral movement often involves internal network connections, authentication events, and endpoint logs. Firewall logs show internal connections, system logs show authentication, and Windows Event Logs track process creation and network connections.

The `http contains "password"` display filter instructs Wireshark to match any HTTP packet whose payload includes the literal string 'password'. The `contains` operator performs a case-sensitive substring search across the entire HTTP protocol data (headers and body), which is exactly what an analyst needs to locate credentials or sensitive terms in HTTP traffic.

A port scan involves an attacker sending TCP SYN packets to multiple ports on a target host to determine which ports are open and listening. The key indicator is the single source IP targeting various ports on a single host, which matches the behavior of a SYN scan (half-open scan) used to map services without completing the full TCP three-way handshake.

The rule requires 10+ failures in 1 minute. In 2 minutes, the rate is 6 per minute, which is below threshold.

Port 443 is the default port for HTTPS (HTTP over TLS). The large volume of traffic during non-business hours, exceeding the baseline, strongly suggests the attacker is using encrypted HTTPS connections to hide data exfiltration. Unlike plaintext HTTP, HTTPS encryption makes it difficult for network monitoring tools to inspect the payload, allowing the attacker to blend malicious traffic with legitimate encrypted web traffic.

In a Snort rule header, the mandatory components are the action (e.g., alert, drop) and the direction operator (-> or <>). While protocol is also a required field, it is not considered a separate mandatory component in the context of this question; the action and direction operator are the two components that are always required in the rule header. Options like msg and sid are part of the rule body and are optional.

0x5A4D is the MZ header for Windows executables (PE files). The rule looks for files starting with 'MZ' and less than 500KB, likely targeting small malware executables.

Repeated login attempts with different usernames from the same IP is typical of a brute force attack against the login page.

The signature 'ET TROJAN Win32.Vobfus Checkin' is a known detection rule for the Vobfus trojan family, which typically establishes command-and-control (C2) communications over HTTPS (port 443) to exfiltrate data or receive instructions. The high severity indicates the IDS/IPS has matched traffic patterns or JA3 hashes associated with this malware's C2 beaconing, making it highly likely that the host at 10.0.0.5 is compromised and communicating with a malicious server at 203.0.113.50.

An Indicator of Compromise (IoC) is a piece of forensic data that identifies potentially malicious activity on a system or network. A file hash (SHA-256) is a classic IoC because it provides a unique cryptographic fingerprint of a known malicious file, allowing security tools to detect its presence across endpoints. This is a specific, actionable artifact that directly points to a compromise.

Multiple POST requests to a login page from a single IP in a short time suggests a brute-force password guessing attack.

DNS tunneling often uses high query volumes, TXT records to encode data, and large response sizes.

The rule uses the Snort 'alert' action, which instructs Snort to generate an alert when the traffic matches the specified conditions (TCP traffic from any port on the home network to port 80 on an external network, with the string 'UNION' present in the payload, case-insensitive). Snort's default behavior for an 'alert' action is to log the packet and generate an alert, but it does not drop or reject the traffic because Snort is an IDS (Intrusion Detection System) by default, not an IPS (Intrusion Prevention System).

A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting resources. The lack of SYN-ACK replies indicates the target is overwhelmed.

The log shows a connection from internal IP 192.168.1.100 to external IP 203.0.113.5 on port 443, with the action 'deny'. Port 443 is the default port for HTTPS (HTTP over TLS), which is used for secure web server access. The 'deny' action indicates the firewall blocked this outbound connection, meaning the internal host attempted to reach a secure web server but was prevented by the firewall policy.

The alert indicates a high-severity Zeus Trojan check-in, which is a known malware communicating with a command-and-control (C2) server. The first priority is to contain the threat by isolating the source host (192.168.1.50) to prevent further data exfiltration or lateral movement. Even though the traffic is encrypted over port 443 (HTTPS), the signature confirms malicious activity, so immediate isolation is the correct initial response per incident response best practices.

A long, random-looking subdomain in a DNS query is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS queries to bypass network security controls. Zeek/Bro logs showing a 'service' of 'dns' with such queries suggest the client is using the DNS protocol to covertly transmit data to an external authoritative server, which decodes and reassembles the payload.

The presence of 'cmd=id' in the URL suggests an attempt to execute the 'id' command via a web shell or command injection vulnerability. The response code 200 indicates success, which is concerning.

Display filters are applied after capture to filter packets based on criteria. A capture filter would limit packets captured, but the question implies after capture. The analyst wants to display only packets with 'password' in payload, which is a display filter.

Prioritizing by severity, correlating with threat intelligence, and checking for associated IoCs help focus on important alerts. Alert fatigue leads to missed incidents; automation and triage are key.

IP addresses are a primary Indicator of Compromise (IoC) because they directly identify the network location of a malicious host, such as a command-and-control (C2) server or a source of an attack. In threat intelligence, IP addresses are used to block traffic, enrich alerts, and correlate events across different data sources. They are a foundational IoC because they are observable in network logs, firewall logs, and IDS/IPS alerts.

A sudden increase in outbound traffic to a single external IP, especially outside business hours, often indicates data exfiltration.

A brute force attack is characterized by a high volume of failed authentication attempts from a single source within a short time window. By alerting on more than 10 failed SSH logins from the same source IP within 1 minute, the rule effectively distinguishes malicious automated guessing from isolated user errors, minimizing false positives while capturing the core behavior of a brute force attempt.

SMB port 445 is a common vector for worm-like malware such as EternalBlue (MS17-010), which spreads by sending crafted SMB packets to random external IPs. The small, consistent traffic volumes and multiple external destinations match the behavior of a host scanning or propagating to new targets rather than normal file transfers.

High NXDOMAIN responses may indicate a DNS amplification attack (using resolvers to amplify traffic) or fast-flux DNS (rapidly changing IPs for malicious domains).

HTTP, FTP, and SMTP are application-layer protocols that operate at Layer 7 of the OSI model. Application-layer attacks target this layer by exploiting vulnerabilities in the application logic, input validation, or protocol implementation, such as SQL injection, cross-site scripting (XSS), or buffer overflows in web servers.

Display filters in Wireshark allow filtering of already captured packets based on criteria like packet content.

A brute force attack involves repeated login attempts using many password guesses. The SIEM rule specifically detects this pattern by counting failed logins from a single source IP within a short time window (1 minute). This matches the signature of an automated password guessing tool, not other attack types.

In Snort, the 'flow:to_server' option directs the rule to match only traffic traveling from the client to the server, based on the direction specified in the rule header. Since the rule header defines the source as $EXTERNAL_NET and destination as $HOME_NET, 'to_server' evaluates traffic flowing from the external network (client) to the home network (server), which is the correct direction for detecting an inbound SMB exploit attempt.

Port 445 is used by SMB for file sharing, but a single internal IP communicating with many external IPs in a short time frame is characteristic of scanning or worm propagation. Worms like EternalBlue exploit SMB vulnerabilities to spread rapidly, generating many outbound connections to random or sequential external IPs on port 445. This pattern is not typical of normal file sharing, which involves sustained connections to known servers.

The correct display filter uses 'ip.addr' to match either direction. The syntax 'ip.addr==192.168.1.10 && ip.addr==10.0.0.5' shows packets where both addresses appear, which is correct for traffic between them.

The rule detects multiple failed logins in a short time, which is characteristic of a brute-force attack.

An IoC is any artifact observed on a network or system that indicates a potential intrusion. File hashes (MD5/SHA-256) are commonly used IoCs.

A high volume of DNS queries to a single domain that is not normally visited is a classic indicator of DNS tunneling, where an attacker encodes exfiltrated data into DNS query subdomains. This behavior creates an abnormal query pattern that stands out in baseline traffic analysis.

The MD5 hash d41d8cd98f00b204e9800998ecf8427e is the well-known hash of an empty file (zero bytes). It is not a valid indicator of a malicious file; the analyst should verify the file's actual content.

Using SIEM for correlation and Wireshark for packet analysis on the server's traffic can help identify the source and nature of the requests.