CCNA Security Monitoring Questions

The signature flags an unusual User-Agent in outbound HTTP, which may indicate malware beaconing or command-and-control traffic. Correlating the source IP with the User-Agent string confirms whether the host is compromised, satisfying the need to validate the alert before escalation.

A port scan sends TCP SYN packets to many ports on one host, seeking open services; the half-open responses distinguish it from a SYN flood, which targets a single port. This matches the stem's multiple-ports-to-one-host pattern.

Filtering on `tcp.port == 443` matches packets where either source or destination TCP port is 443, isolating HTTPS flows regardless of direction. This satisfies the analyst's requirement to display all HTTPS traffic in the PCAP, since HTTPS conventionally runs over TCP port 443.

Counting unique destination IPs above a threshold captures the horizontal spread of a scan, where one source probes many hosts. Combined with port and time-window conditions, it satisfies the stem's requirement to detect scanning across multiple hosts rather than a single target.

The http.log records HTTP transactions, capturing request methods, URIs, host headers, response status codes and user agents. This directly satisfies the stem's requirement to identify HTTP methods, URIs and response codes from web traffic, whereas conn.log, dns.log and ssl.log lack application-layer HTTP detail.

DNS tunneling uses subdomains to encode data.

The rule alerts on TCP port 80, matching the HTTP POST, and the pcre option detects a User-Agent exceeding 200 characters, which is the exploit's signature. The content match on POST plus the regex satisfies the requirement to detect this Apache-targeting request.

A PSH, ACK from the client indicates it is sending data to the server. The server's RST, ACK response means it is abruptly resetting the connection, which can occur if the application encounters an error, the server is enforcing a security policy (e.g., IPS blocking), or the service is misconfigured. The client then stops sending, consistent with a reset. This is the most likely explanation for the observed flags.

HTTPS uses TLS over TCP port 443 to encrypt web traffic, satisfying the stem's requirement for a secure web protocol and port pair. Plain HTTP on port 80 provides no transport encryption, so 443 is the standard secure alternative.

The command 'net user hacker P@ssw0rd /add' is used to create a new local user account named 'hacker' with the password 'P@ssw0rd'. This is a common persistence technique used by attackers to maintain access to a compromised system. The '/add' switch explicitly adds the user, and the syntax matches the Windows net user command. This is the most likely intent based on the string.

A SYN scan sends SYN packets and never completes the three-way handshake. The server responds with SYN-ACK for open ports, but the scanner does not send the final ACK, so no full connection is established. This half-open behavior across many ports on one server is characteristic of a port scan.

The suppress option tells Snort to ignore traffic matching a specified source or rule, so known benign IPs stop generating alerts. This directly reduces false positives, satisfying the stem's sensitivity-reduction goal, because trusted hosts no longer trigger signatures during routine activity.

Port 445 carries SMB (Server Message Block), Microsoft's protocol for file and printer sharing, named pipes and remote administration. Unusual volumes on 445 often indicate ransomware propagation, lateral movement or data exfiltration, making SMB the protocol to investigate.

The periodic, fixed-interval queries with random subdomains to one domain, combined with NXDOMAIN responses, are classic signs of a DNS beacon. The implant generates unique subdomains to check in and receives no response because the C2 domain may not be active yet or the analyst is seeing only the beacon attempts. This pattern is a well-known indicator of compromise.

Malware often masquerades as HTTPS by using port 443 while speaking a custom binary protocol to evade port-based filtering and TLS inspection. The periodic small keepalives are a hallmark of beaconing, where the implant checks in with its controller at regular intervals. Because the traffic is not actually TLS, signature-based TLS inspection will not flag it, making behavioral analysis essential for detection.

Pass-the-Hash attacks often leverage SMB for lateral movement. Capturing network traffic that includes NTLMSSP authentication attempts can reveal the use of NTLM hashes instead of plaintext passwords. Specifically, the NTLMSSP_AUTH message contains the username and the challenge response derived from the hash. If the same hash is used from multiple hosts or in an unusual pattern, it strongly suggests Pass-the-Hash. This artifact provides direct network-level evidence.

Endpoint detection and response (EDR) or endpoint protection platform telemetry records process execution, file modification, registry changes, and command-line arguments on the target. Correlating the Firepower intrusion event timestamp and source IP with this endpoint data reveals whether the dropped packet was part of a successful exploit chain or whether the host actually spawned a malicious process. This is the authoritative source for confirming host-level compromise after a partial network capture.

Using one service account to authenticate to many servers over SMB suggests credential reuse for lateral movement, especially if the account is not normally used interactively. Attackers commonly harvest service account credentials and spray them across hosts, so this pattern supports the SMB lateral movement hypothesis.

The first step in the incident response process is to validate that the alarm represents a real security event and to identify the affected asset and user. This establishes scope, confirms whether the traffic is expected, and determines whether escalation is warranted. Only after validation and identification can the analyst make informed containment decisions. Jumping to blocking or disabling accounts without this step risks disrupting legitimate business activity and missing related compromised systems.

Suppression rules let the IDS ignore matching traffic from the specific source IP or application while retaining the signature for all other sources, eliminating the recurring false positives without losing genuine detection coverage. This directly addresses the high false-positive rate constraint.

Oversized ICMP echo requests exploit the protocol's normal 64-byte payload ceiling, indicating tunnelling or data exfiltration hidden inside ping traffic. This satisfies the stem's malicious-activity criterion because legitimate diagnostics never require 65,000-byte payloads, and such frames often signal covert channels or ping floods.

Repeated denied connections to port 22, the SSH service, from one source indicate automated credential guessing against remote shell access. The firewall's consistent blocking of these attempts confirms brute-force behaviour rather than legitimate administrative traffic, matching the log pattern described in the stem.

Web server logs record each HTTP transaction, capturing request method, URL path, query strings, status codes and User-Agent headers. This satisfies the requirement for detailed request-level data, unlike firewall logs that show only connection metadata or NetFlow records lacking application-layer detail.

NetFlow/IPFIX records flow metadata — source, destination, byte counts and timestamps — letting the analyst compare the 50 MB foreign transfer against the 1-2 MB hourly baseline. Encryption hides payload contents, but flow volume and destination still confirm exfiltration.

Sudo execution records commands run with elevated privileges, making it a direct indicator of privilege escalation attempts. Monitoring these events reveals when a user gains or attempts root-level access, satisfying the requirement to detect escalation activity in system logs.

SMB on port 445 is used by ransomware and worms such as WannaCry to propagate laterally. Repeated outbound attempts to many external addresses indicate the workstation scanning for reachable SMB shares, consistent with infection rather than legitimate file sharing.

When a domain is categorized as malware and command-and-control with a high security score, the immediate priority is to prevent further communication and identify affected hosts. Blocking at DNS via Umbrella stops resolution, and querying logs for internal clients that resolved the domain helps scope the incident. This aligns with containment and investigation best practices.

DNS server response logs record whether a query received a valid answer, an NXDOMAIN, or a blocked response from a protective DNS service. This directly shows if the domain was resolved or denied, answering whether the workstation could have connected. Correlating these responses with firewall or proxy logs then confirms whether an actual connection followed the resolution.

The alert indicates an attempted exploit against a known vulnerable version of Apache Struts2. The analyst must determine if the exploit succeeded by examining web server logs, looking for unusual processes or files, and confirming the patch level. This response aligns with incident handling: validate the alert, assess impact, and contain if necessary.

The Network layer (Layer 3) handles logical addressing and routing, satisfying the stem's requirement. IP spoofing attacks forge source addresses within IP packets at this layer, exploiting the lack of authentication in the IP protocol. This makes Layer 3 the precise target, unlike the Transport layer's ports or Data Link layer's MAC addresses.

Port 3389 is the registered TCP port for Remote Desktop Protocol, so a deny rule targeting it blocks RDP sessions. The stem's constraint — destination port 3389 — maps directly to RDP, Microsoft's protocol for remote graphical access to Windows hosts. No other listed service uses this port.

Two simultaneous active VPN sessions from distant geographies within four minutes cannot be produced by one traveler with one device, since physical travel between those points is impossible in that interval. This pattern is a classic indicator of stolen credentials being used in parallel with the legitimate user. Treating the account as compromised and verifying with the user is the correct monitoring response.

Normalization standardizes log data.

Cisco Talos Intelligence maintains a database of file hashes associated with malware. When a hash query returns a known malware detection name, it means the exact file has been previously identified as malicious. This is a strong indicator that the file is indeed malware, and the analyst should treat it as such, initiating incident response procedures.

The successful login is the pivot point: after repeated failures, it signals the attacker guessed valid credentials and gained access. Correlating it with the preceding failures and the following privilege escalation confirms a brute-force-to-compromise chain rather than isolated noise.

A port scan sends TCP SYN packets to many ports on one host, seeking open services. The half-open SYN pattern, with no completed handshake, distinguishes scanning from a SYN flood, which targets a single port. This matches the stem's high-volume SYN traffic to various ports.

The log shows a denied TCP connection from an external IP (203.0.113.5) on port 443 to an internal IP (10.1.1.10) on port 3389. Port 3389 is used for RDP. The firewall denied the connection, indicating an attempt to access RDP from the outside was blocked. This is a common indicator of scanning or exploitation attempts.

DGAs produce many pseudo-random subdomains that malware queries until one resolves to a C2 server. The NXDOMAIN responses for most queries are expected because only a few generated domains are registered by the attacker. This pattern, with high volumes of random-looking names under one domain, is a classic DGA indicator in DNS logs.

Event 4769 records Kerberos service ticket requests. A burst of requests for multiple service principal names using RC4, the weaker encryption type, from a single non-server host matches the Kerberoasting pattern, since the attacker requests tickets and cracks them offline. The volume, encryption downgrade, and unusual requesting host together distinguish this from normal service access.

The deny action combined with destination port 22 shows a connection attempt to the SSH service that the firewall rejected. The source host never established a session, so the entry records blocked traffic rather than a successful login.

Hundreds of distinct destination addresses contacted in a very short window, each with minimal data transferred, is the classic NetFlow signature of a host sweep. Because the flows target port 443, the sweep is aimed at discovering reachable HTTPS services. NetFlow's IP, port, and byte-count fields are sufficient to identify this fan-out behavior without full packet capture.

SNMP traps are unsolicited notifications sent from agents to the manager, and they travel over UDP port 162. The manager listens on 162, while queries use UDP 161. This connectionless transport suits one-way alert delivery without acknowledgement overhead.

Port 4444 is commonly used by Metasploit and other penetration testing or malware tools for reverse shells. The command 'cmd.exe /c whoami' is a typical reconnaissance command executed through a shell. The combination of a non-standard high port and command execution strongly suggests a reverse shell, where the compromised host connects back to the attacker's listener.

Outbound SMB connections to multiple internal servers on port 445 using a single domain account within a short window strongly suggest lateral movement. Attackers who have compromised one host often use stolen credentials to access file shares or administrative shares on other systems, spreading malware or establishing additional footholds. This pattern is a classic indicator that should trigger immediate containment and credential reset.

The 'MZ' signature at offset 0 confirms a Windows PE executable, while 'CreateRemoteThread' indicates process injection capability. Together these satisfy the stem's detection criteria for a malicious executable, since legitimate binaries rarely combine a valid PE header with remote thread creation for code injection.

The Network layer (layer 3) handles logical addressing through IP addresses and determines path selection via routing protocols, forwarding packets between networks. Layers 2 and 4 handle physical addressing and transport respectively, so neither performs routing.

A correlation rule engine ingests and normalises logs from disparate sources, then matches event patterns across them to surface multi-stage attacks that isolated alerts would miss. This directly satisfies the stem's requirement for a security monitoring function, since correlation is a core SIEM capability rather than an endpoint or network control.

Cisco Stealthwatch collects NetFlow and other flow data to provide network visibility and detect anomalies. It is designed for network flow analysis, helping analysts identify unusual traffic patterns and potential threats. In this scenario, it would supply the network flow data needed to understand communication patterns.

Repeated authentication failures from one source within a short window indicate systematic credential guessing, the defining signature of brute-force attacks. The rule's threshold and time constraint detect this volume-based pattern, distinguishing it from single failed logins or distributed password spraying across many accounts.

Ten failed authentications from one source within a minute indicates repeated credential guessing against an account, the defining pattern of brute force. The rule's threshold and one-minute window directly capture that volume-based signature, distinguishing it from a single failed attempt or a slow, low-rate password spray.

Zeek's SMTP analyser parses email transactions at the application layer, producing smtp.log with fields such as sender, recipient, subject and helo, satisfying the requirement for application-layer visibility. It captures protocol-level mail activity rather than transport metadata, so it directly evidences application-layer behaviour in the monitored traffic.

Polymorphic and repacked malware changes its bytes between builds or executions, producing a new SHA-256 each time while often retaining a familiar file name. The intelligence feed's hash identifies one specific sample, so the absence of that hash does not mean the malware is absent. This explains why name-based sightings persist without a hash match and why behavioural detection matters.

Regular, periodic connections to a known C2 server are characteristic of malware beaconing. The interval and small data size suggest the malware is checking in for instructions. This is a common detection for command-and-control activity. The analyst should investigate the host for compromise and block the C2 communication.

Windows Event Logs capture process creation (Sysmon Event ID 1) and network connection events (Event ID 3), exposing the parent-child process chains and outbound connections lateral movement tools generate. This directly satisfies the SIEM tuning requirement by supplying host-level telemetry that reveals anomalous execution and remote connection patterns across endpoints.

A port scan sends TCP SYN packets to many ports on one host to map which services are listening. Half-open scans exploit the SYN/ACK or RST response to classify each port as open, closed or filtered, matching the stem's single source IP and multiple destination ports.

Sysmon Event ID 13 records registry value set operations, including changes to Run keys, which are a common persistence mechanism. By capturing the process that wrote the value and the exact registry path, analysts can identify which executable will launch at logon. This directly supports the persistence portion of the investigation and links the registry change to a specific process on the infected host.

The rule's threshold is bound to a one-minute sliding window, so twelve failures spread across two minutes never accumulate ten events inside any single window. The correlation engine evaluates count per interval, not cumulative totals, so the two-minute duration itself prevents the threshold from being met.

Sustained high-volume traffic to an external address on port 443 outside business hours indicates data being tunnelled inside encrypted HTTPS sessions, evading content inspection. The volume and timing deviation from baseline satisfy the scenario's exfiltration indicators.

The uint16(0) == 0x5a4d check reads the MZ magic bytes at offset zero, the DOS header signature unique to Windows PE executables. The filesize constraint simply limits scanning to smaller binaries, confirming the rule targets Windows executable files.

The ET TROJAN signature name indicates known malware, and port 443 traffic to an external address represents beaconing over TLS to evade inspection. Source 10.0.0.5 is therefore a compromised internal host checking in with command-and-control infrastructure, matching the alert's encrypted-channel characteristics.

DGAs are used by malware to generate a large number of pseudo-random domain names that it can query to find its command and control server. The pattern of many random-looking domains, often with different top-level domains, and queries to various DNS servers, is a classic indicator of DGA activity. This allows the malware to evade domain blacklisting. The analyst should correlate with endpoint logs to identify the infected host.

Port 445 is used by SMB. A single host connecting to many external IPs on that port in a short time with short flows is characteristic of a worm or scanner trying to find vulnerable SMB services. This pattern is typical of exploits like WannaCry or NotPetya, which scan and propagate. The high fan-out and small packet counts indicate scanning, not normal file sharing.

Endpoint telemetry correlates process creation, loaded modules, and outbound socket events, so it can tie the browser plugin process to the connection attempts to 203.0.113.55:4444. That directly confirms whether a C2 channel was established by the vulnerable plugin, which network-only sources cannot do. It also captures the reset timing, showing failed versus successful C2 sessions.

Windows Security event logs record authentication events such as logon type 3 network logons, explicit credential use, and privileged logon activity. When an attacker moves laterally using stolen credentials or remote execution tools, these logs capture the source workstation, target host, account, and logon type. Correlating these events across endpoints reveals the path of movement. SecureX or a SIEM can aggregate these logs, making them one of the most direct sources for detecting lateral movement in a Windows environment.

A SHA-256 file hash is a concrete, artefact-based IoC: it uniquely identifies known-malicious files, letting analysts search endpoints and logs for that exact value. Unlike behavioural heuristics, the hash is a static forensic indicator satisfying the stem's requirement for an IoC example.

Long, high-entropy subdomain labels sent repeatedly to one domain, with no follow-on connection to the answers, indicate data being encoded into DNS queries for covert transfer. Legitimate resolution produces a connection or cached result; here the query itself is the payload channel. This pattern lets an attacker move data out through recursive resolvers that most networks permit by default.

One hundred POST requests to the login endpoint from a single IP within five seconds indicates automated credential guessing against the authentication form. The rapid repetition and uniform user-agent reveal scripted abuse rather than human login behaviour, matching brute-force attack characteristics.

DNS tunnelling exfiltrates data by encoding payloads into DNS queries and responses, and TXT records carry arbitrary text up to 255 characters per string, making them the preferred carrier. Frequent TXT queries to a single domain, especially with high entropy or long labels, satisfy the stem's command-and-control hypothesis.

The rule header specifies alert as its action, so Snort logs the matching packet and generates an alert without dropping or blocking it. This satisfies the stem's requirement, since the rule detects the "UNION" string in outbound port 80 traffic but Snort's default alert action is passive monitoring, not prevention.

SYN packets to varied ports with no SYN-ACK replies indicate half-open connections exhausting the target's backlog queue. This matches a SYN flood, a volumetric denial-of-service attack that never completes the TCP handshake, distinguishing it from port scans that typically elicit RST responses.

Port 443 indicates HTTPS, so the internal host initiated a connection to a secure web server. The deny action confirms the firewall blocked it, matching the stem exactly. This is outbound filtering, not an inbound attack or a non-web protocol attempt.

Examining the full packet capture allows the analyst to see the actual payload and server response. If the payload matches known exploit patterns and the server responds with a shell or unusual behavior, it is a true positive. If the payload is benign or the server rejects it, it may be a false positive. This is the most direct method to validate the alert.

The signature indicates an active Zeus trojan check-in from internal host 192.168.1.50 to external infrastructure over port 443, confirming likely compromise and command-and-control beaconing. Isolating that host immediately halts exfiltration and lateral movement, the priority containment step before deeper forensic analysis.

DNS tunnelling encodes stolen data within subdomain labels of queries sent to an attacker-controlled authoritative nameserver. Zeek's `service` field identifying DNS, combined with an abnormally long, high-entropy subdomain, satisfies the exfiltration indicator: legitimate DNS labels are short and structured, whereas tunnelled payloads appear random to evade signature matching.

The query string passes 'cmd=id' to a PHP script, indicating the attacker is attempting to execute the shell command 'id' via an unsanitised parameter. A 200 response suggests the command injection succeeded, satisfying the log evidence for this attack type.