75 of 99 questions · Page 1/2 · Cbrops Intrusion Analysis topic · Answers revealed
An analyst detects HTTPS traffic to a domain that was registered only 24 hours ago and has no web content. The traffic occurs at odd hours and with consistent packet sizes. What technique is likely being used for C2?
HTTPS to a suspicious domain is common C2.
Why this answer
Attackers often use newly registered domains (DGAs or manually registered) for C2 to avoid blacklists. HTTPS provides encryption to hide the beaconing.
A security analyst is investigating a PCAP and sees the following HTTP POST request: POST /login HTTP/1.1 ... username=admin&password=letmein. Which TWO attack indicators are present?
The password 'letmein' is a common weak password.
Why this answer
The plaintext credentials in an HTTP POST indicate credential theft (sniffing) and the use of weak or default passwords (common attack vector).
Which of the following is a common indicator of DNS tunneling used for exfiltration?
Correct. Long subdomain strings are a sign of DNS tunneling.
Why this answer
DNS tunneling exploits the DNS protocol to encapsulate non-DNS data within DNS queries and responses. A common indicator is DNS queries with unusually long subdomain strings, as attackers encode exfiltrated data into the query name to bypass network security controls.
Exam trap
Cisco often tests the distinction between a general anomaly (like large DNS responses) and a specific tunneling indicator (long subdomain strings), where candidates mistakenly focus on response size or protocol choice rather than the query structure.
How to eliminate wrong answers
Option B is wrong because frequent DNS queries to known domains are typical of legitimate client behavior (e.g., CDN lookups) and not a specific sign of tunneling. Option C is wrong because while DNS responses can carry large payloads in tunneling, the primary indicator is the query side; moreover, standard DNS responses are limited to 512 bytes (or up to 4096 bytes with EDNS0), so large responses alone are not definitive. Option D is wrong because DNS queries normally use UDP, but tunneling can use TCP for reliability; however, TCP usage is not a common indicator because many legitimate operations (e.g., zone transfers) also use TCP.
A security analyst is investigating an alert that indicates a potential SQL injection attack. Which of the following HTTP request patterns is most indicative of a SQL injection attempt?
The UNION SELECT statement is a SQL injection technique to extract data from other tables.
Why this answer
SQL injection often involves injecting SQL keywords like UNION or SELECT into parameters. 'id=1 UNION SELECT' is a classic example.
An analyst identifies a series of SMB authentication attempts from a compromised host to multiple internal servers. The authentication uses NTLM hashes. Which TWO techniques are most likely being used for lateral movement? (Select 2)
Relays authentication to other hosts.
Why this answer
SMB relay (B) is correct because the attacker can intercept NTLM authentication attempts from the compromised host and relay them to other internal servers, gaining unauthorized access without needing to crack the hash. This technique leverages the SMB protocol's lack of channel binding in older implementations, allowing the relayed hash to authenticate to multiple targets.
Exam trap
Cisco often tests the distinction between 'pass-the-hash' (reusing a hash directly from the compromised host) and 'SMB relay' (forwarding the authentication challenge to another server), which candidates confuse as the same technique.
Which Wireshark filter can be used to extract the full TCP data of a specific conversation from a PCAP?
Filters by TCP stream index for conversation reconstruction.
Why this answer
The tcp.stream filter allows viewing a specific TCP stream by its number, which is useful for analysis.
An analyst is examining a PCAP file for signs of lateral movement. Which TWO of the following are typical indicators of lateral movement using pass-the-hash?
SMB is commonly used for lateral movement in Windows environments.
Why this answer
Pass-the-hash attacks use NTLM authentication with hashed credentials. Indicators include multiple SMB authentication attempts from one host to many others and the use of NTLM hashes.
During network intrusion analysis, an analyst reviews logs and observes an alert for a TCP SYN scan. Which characteristic of a SYN scan would the analyst look for in packet captures?
Correct. SYN scan sends RST after SYN-ACK to avoid establishing a full connection.
Why this answer
A SYN scan sends a SYN packet and, upon receiving a SYN-ACK from the target, responds with a RST instead of completing the handshake. This avoids a full connection and is stealthier.
In network forensics, which Wireshark filter would be used to reconstruct a TCP conversation between two hosts?
Correct. tcp.stream allows viewing the full TCP conversation.
Why this answer
The tcp.stream filter isolates all packets belonging to a specific TCP connection.
An analyst is reviewing PCAP and sees a TCP stream with a Wireshark filter 'tcp.stream eq 0'. The conversation shows an interactive shell session with commands like 'whoami' and 'ls'. This is most likely evidence of what?
Reverse shell provides command-line access.
Why this answer
An interactive shell session over TCP indicates a reverse shell, allowing the attacker to execute commands remotely.
An analyst is investigating a potential DNS tunneling attack. Which characteristic in DNS traffic would most likely indicate DNS tunneling?
Correct. Tunneling encodes data in subdomains, making them long and random.
Why this answer
DNS tunneling often encodes data in subdomains, resulting in long, random-looking domain names that differ from legitimate traffic.
In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?
UNION SELECT is a classic SQL injection pattern.
Why this answer
SQL injection attacks often include SQL keywords like UNION and SELECT in crafted parameters.
Which MITRE ATT&CK tactic corresponds to the Cyber Kill Chain phase 'Actions on Objectives'?
Impact includes data destruction, denial of service, etc.
Why this answer
In MITRE ATT&CK, the tactic 'Impact' covers actions that disrupt or damage systems, similar to 'Actions on Objectives' where the attacker achieves their goal.
An analyst identifies HTTP traffic containing the string "<script>alert('XSS')</script>" in the URL parameter. Which TWO attack types are likely being attempted?
Injecting HTML tags is HTML injection.
Why this answer
The script tag is classic XSS; HTML injection occurs when attacker injects HTML content.
An analyst reviews network logs and sees a large outbound FTP transfer of 500 MB from a workstation to an external IP at 2:00 AM. The workstation regularly sends 10 MB daily. What should the analyst suspect?
Anomalous large transfer is suspicious for exfiltration.
Why this answer
Large outbound data transfers outside normal patterns, especially at odd hours, are typical of data exfiltration.
During alert triage, an analyst determines that an alert fired but no actual attack or malicious activity occurred on the network. How should this alert be classified?
False positive is an alert without an actual attack.
Why this answer
A false positive is an alert that triggers incorrectly when no real attack exists. True positive means attack confirmed, false negative means attack missed, true negative means no alert and no attack.
An alert shows a high volume of outbound traffic from an internal host to an external IP using FTP. The data includes files with names matching internal document names. This activity is most likely:
Large outbound FTP transfers of internal documents indicate exfiltration.
Why this answer
Exfiltration via FTP is a common technique to steal data by transferring it to an external server.
Which TWO of the following are valid classifications for alerts during triage?
Correct. True positive indicates a real attack.
Why this answer
True positive and false positive are standard alert classifications.
The attack payload is present, confirming a real attack.
Why this answer
The alert corresponds to a real attack (cross-site scripting) in the traffic, so it is a true positive.
An analyst is examining a PCAP for signs of pass-the-hash attack. Which THREE indicators would be consistent with pass-the-hash?
Correct. Lateral movement often uses pass-the-hash across multiple hosts.
Why this answer
Pass-the-hash uses NTLM authentication with a hash, often over SMB, and may show successful authentication without password.
During a network intrusion analysis, a security analyst observes repeated TCP SYN packets sent to a range of ports on a target host, each followed by an RST response. No subsequent ACK packets are observed. Which phase of the Cyber Kill Chain is the attacker most likely executing?
SYN scan is a reconnaissance activity to identify open ports and services.
Why this answer
The SYN scan is a reconnaissance technique used to identify open ports without completing the TCP handshake. The RST response indicates the port is closed, and the lack of ACK means the handshake was intentionally not completed, characteristic of a SYN scan.
An analyst is analyzing a PCAP from a compromised host. Which THREE of the following are common indicators of exploitation attempts in network traffic?
ROP gadgets bypass DEP and are exploitation indicators.
Why this answer
Exploitation indicators include shellcode patterns (NOP sleds, ROP gadgets) and heap spray (large blocks of similar data).
An analyst is investigating a potential malware infection. Which TWO of the following are indicators of command and control (C2) communication?
Correct. DNS tunneling often uses long subdomains for C2.
Why this answer
Beaconing at regular intervals and DNS queries with encoded subdomains are classic C2 indicators.
An analyst observes a host making outbound connections to a server on TCP port 443, with traffic patterns showing small packets at regular 60-second intervals. The destination IP is in a country where the company does no business. Which THREE characteristics suggest this is C2 beaconing?
Correct. Regular periodic small packets indicate beaconing.
Why this answer
Beaconing often uses HTTPS to evade detection, has periodic regular intervals, and goes to unusual destinations. Small packets at fixed intervals are classic.
An analyst observes a series of DNS queries for subdomains like 'ZGVzdGluYXRpb24= .malicious.com' where the subdomain part appears base64-encoded. The volume of DNS traffic from a single host is unusually high. Which exfiltration technique is most likely in use?
Encoded data in DNS subdomain queries is a hallmark of DNS tunnelling/exfiltration.
Why this answer
DNS exfiltration encodes data in subdomain queries to bypass traditional monitoring.
A security analyst is investigating a suspected data exfiltration incident. Which TWO of the following indicators are most consistent with exfiltration over DNS?
Oversized TXT records can be used to deliver exfiltrated data.
Why this answer
DNS exfiltration involves encoding data in subdomain queries, often with high entropy, and can use TXT records to retrieve data.
A network analyst is examining a PCAP file and applies the Wireshark display filter 'http.request'. The results show several POST requests to '/login.php' with parameters containing 'username=admin&password=secret'. What type of attack is indicated?
Plaintext credentials transmitted over HTTP indicate likely credential theft.
Why this answer
Plaintext credentials in HTTP POST bodies indicate credential theft, possibly via phishing or a compromised web form.
An analyst reviewing network alerts notices a rule triggered for 'ET SCAN NMAP -sU scan' based on traffic to a Linux server. The packet capture shows multiple UDP packets to various ports, and for closed ports, the server responds with ICMP Destination Unreachable (Port Unreachable). Which type of scan is being performed, and how should the analyst classify this alert?
The UDP scan is correctly detected by the alert, so it is a true positive.
An analyst examines PCAP and sees multiple SMB sessions from internal host 10.1.1.10 to 10.1.1.20, 10.1.1.30, and 10.1.1.40 within seconds. The NTLM authentication contains a hash parameter that is identical across sessions. Which lateral movement technique is most likely being used?
Identical NTLM hash across multiple SMB sessions indicates pass-the-hash.
Why this answer
Pass-the-hash uses the same NTLM hash to authenticate to multiple hosts without knowing the plaintext password.
An analyst is reviewing PCAP from a network intrusion. The attacker used a payload with ROP gadgets and shellcode. Which TWO exploitation indicators are associated with this attack? (Choose two.)
ROP gadgets are small instruction sequences used to chain calls.
Why this answer
Shellcode is the actual executable code injected; ROP gadgets are used to bypass DEP by chaining existing code.
During a network intrusion investigation, an analyst notices repeated SMB authentication attempts from a single host to multiple other hosts using different usernames. Which type of activity does this pattern suggest?
Correct. Attempting to authenticate to multiple hosts indicates lateral movement.
Why this answer
Lateral movement via SMB involves authenticating to multiple hosts, often with different credentials, to move across the network.
During an incident, an analyst observes the following in PCAP: (1) DNS queries with random-looking subdomains to a known malicious domain, (2) large outbound FTP transfers of .zip files, (3) HTTP POST requests with Base64-encoded data in the body. Which THREE exfiltration techniques are being used? (Select 3)
Large FTP transfers.
A security analyst observes a large number of SYN packets sent to various ports on a target host, receiving RST responses for closed ports and no response for open ports. Which phase of the Cyber Kill Chain does this activity represent?
Port scanning is a reconnaissance technique to identify vulnerabilities.
Why this answer
The observed behavior—sending a large number of SYN packets to various ports and analyzing RST responses (closed ports) versus no response (open ports)—is a classic port scan, specifically a SYN scan. This activity maps the target's attack surface by identifying live hosts and open ports, which aligns with the Reconnaissance phase of the Cyber Kill Chain, where the adversary gathers information to plan an attack.
Exam trap
Cisco often tests the distinction between Reconnaissance and Weaponisation, where candidates mistakenly think that sending crafted packets (SYN) is part of weaponisation, but weaponisation specifically involves creating the exploit or payload, not the scanning activity.
How to eliminate wrong answers
Option B (Weaponisation) is wrong because weaponisation involves coupling a payload with a delivery mechanism (e.g., creating a malicious document or exploit kit), not scanning for open ports. Option C (Exploitation) is wrong because exploitation requires actively leveraging a vulnerability to gain unauthorized access, whereas a SYN scan only identifies potential targets without attempting to compromise them. Option D (Delivery) is wrong because delivery refers to transmitting the weaponized payload to the target (e.g., via email or USB), not the pre-attack reconnaissance of scanning ports.
An analyst identifies a PCAP with a reverse shell session. Which characteristic in the traffic would most likely indicate an interactive shell session?
Correct. Interactive shells show bidirectional small packets with commands and responses.
Why this answer
Reverse shells often exhibit bidirectional traffic with interactive patterns, such as small irregular packets and commands echoed.
During an incident response, an analyst extracts a file from a PCAP using Wireshark's 'Export Objects' feature. The file contains shellcode that uses NOP sleds and encodes a reverse shell command. Which Cyber Kill Chain phase does this file represent?
The file was delivered over the network, so it is in the delivery phase.
Why this answer
The file contains shellcode and is extracted from network traffic, indicating it was delivered to the target. This aligns with the delivery phase.
A PCAP contains the following patterns: (1) A TCP connection with a complete handshake to an external IP on port 443, (2) periodic data transfers every 60 seconds of approximately 1 KB, (3) the domain name in the TLS SNI field is generated by a DGA. Which THREE indicators are present?
Regular intervals (60s) indicate beaconing.
Why this answer
Beaconing is periodic callbacks, C2 over HTTPS uses port 443, and DGA domains indicate automated C2 infrastructure.
During a forensic analysis, an analyst uses NetworkMiner to extract files from a PCAP. One of the extracted files contains a PE executable with a known signature of a malware variant. Which phase of the Cyber Kill Chain does the file transfer most likely represent?
Delivery transfers the weaponized payload.
Why this answer
The file transfer from the PCAP represents the Delivery phase because NetworkMiner extracted a PE executable that was transmitted over the network, likely via HTTP, SMTP, or SMB. In the Cyber Kill Chain, Delivery is the phase where the weaponized payload is transmitted to the target system, which is exactly what a file transfer in a PCAP captures. The presence of a known malware signature confirms the payload was delivered, not yet executed or exploited.
Exam trap
Cisco often tests the distinction between Delivery and Exploitation, where candidates mistakenly choose Exploitation because they see a malware file, but the PCAP only shows the transfer, not the execution or vulnerability trigger.
How to eliminate wrong answers
Option A is wrong because Reconnaissance involves gathering information about the target (e.g., scanning, OSINT) and does not include transferring a malware executable. Option B is wrong because Weaponization is the phase where the attacker creates the malicious payload (e.g., coupling exploit with backdoor), but the file transfer itself is not the creation step. Option C is wrong because Exploitation occurs when the delivered payload triggers a vulnerability to execute code; the PCAP file transfer only shows the delivery, not the execution or trigger.
An analyst notices periodic HTTP GET requests to a suspicious domain every 60 seconds. The payload size is small and consistent. This behavior is characteristic of which phase of the Cyber Kill Chain?
Correct. Regular beaconing is typical of C2.
Why this answer
Beaconing is a C2 communication technique where infected hosts periodically contact the command server.
While analyzing a PCAP, an analyst uses the Wireshark filter 'http.request' and finds a URI parameter containing '%27%20UNION%20SELECT%201,2,3%20--'. What type of attack is indicated?
UNION SELECT is a classic SQL injection technique.
Why this answer
The URL-encoded string decodes to a SQL injection attempt with UNION SELECT. SQL injection often appears in HTTP parameters.
A SOC analyst sees an alert for 'Possible SQL Injection' on a web server. Reviewing the PCAP, the analyst finds the parameter 'id=1 OR 1=1' in the HTTP request. However, the web server returns a normal page with no signs of compromise. What is the correct classification?
The alert triggered but no real attack took place.
Why this answer
The alert fired on a pattern that resembles SQL injection, but the server was not vulnerable or the input was sanitized; thus no actual attack occurred.
An intrusion detection system alerts on HTTP traffic containing the string 'UNION SELECT' in the URI parameter. This is most indicative of what type of attack?
Correct. UNION SELECT is a classic SQL injection technique.
Why this answer
The alert detects the string 'UNION SELECT' in a URI parameter, which is a classic SQL injection payload used to combine results from multiple database queries. This indicates an attacker is attempting to manipulate SQL queries by injecting malicious SQL code through user input, a hallmark of SQL injection attacks.
Exam trap
Cisco often tests the distinction between injection types by using specific payload strings; the trap here is confusing SQL injection with command injection because both involve 'injection', but the 'UNION SELECT' syntax is unique to SQL and not used in command injection or other attacks.
How to eliminate wrong answers
Option B is wrong because command injection involves executing system commands (e.g., via shell metacharacters like ';' or '|') rather than SQL statements like 'UNION SELECT'. Option C is wrong because cross-site scripting (XSS) typically injects client-side scripts (e.g., JavaScript) into web pages, not SQL syntax in URI parameters. Option D is wrong because directory traversal exploits path traversal sequences (e.g., '../') to access restricted files, not SQL query manipulation.
A PCAP contains an HTTP POST request with a parameter containing "UNION SELECT username, password FROM users". This is evidence of:
UNION SELECT in a parameter is classic SQL injection.
Why this answer
SQL injection attacks often use UNION SELECT statements to extract data from databases via web application vulnerabilities.
An analyst reviews PCAP traffic and sees a series of HTTP POST requests from an internal host to an external IP at exactly 60-second intervals. The payload size is consistent. Which phase of the Cyber Kill Chain does this activity most likely represent?
Beaconing is a hallmark of C2.
Why this answer
The consistent 60-second intervals and uniform payload size of HTTP POST requests from an internal host to an external IP are classic indicators of beaconing activity. In the Cyber Kill Chain, this behavior aligns with the Command and Control (C2) phase, where an established foothold communicates with an external C2 server to receive instructions or exfiltrate data. The use of HTTP POST mimics normal web traffic to evade detection, a common technique in C2 channels.
Exam trap
Cisco often tests the distinction between beaconing (C2) and data exfiltration (Actions on Objectives), where candidates mistakenly associate any external HTTP POST with data theft rather than recognizing the periodic pattern as command-and-control signaling.
How to eliminate wrong answers
Option A is wrong because the Delivery phase involves the initial transmission of the exploit or payload to the target (e.g., via phishing email or malicious download), not periodic beaconing after compromise. Option C is wrong because Actions on Objectives refers to the final goal, such as data exfiltration or system destruction, which would show larger or irregular data transfers, not consistent small beacons. Option D is wrong because Installation is the phase where malware is placed on the system (e.g., writing to disk or registry), which occurs before C2 and does not involve periodic network traffic.
An analyst is reviewing a PCAP and sees multiple HTTP requests with the parameter 'id=1 UNION SELECT username,password FROM users'. What type of attack is being attempted?
Correct. UNION SELECT is classic SQL injection payload.
Why this answer
The SQL keywords UNION and SELECT in a parameter indicate a SQL injection attempt to extract data from the database.
During incident response, an analyst extracts files from a PCAP using Wireshark's Export Objects feature. One extracted file is a PDF that triggers an IDS alert for 'Exploit:PDF/HeapSpray'. Which technique does this alert describe?
Heap spray loads shellcode into heap memory to hijack execution.
Why this answer
Heap spray is a memory corruption technique where an attacker fills heap memory with shellcode to increase the chance of code execution, often used in PDF exploits.
A security analyst observes periodic outbound HTTPS connections to an unusual domain that resolves to different IP addresses each time. This behavior is most indicative of:
Periodic HTTPS connections to DGA domains indicate C2 beaconing.
A security analyst is investigating a potential exploit. The PCAP shows a HTTP POST request containing a long string of characters that, when decoded, reveals a series of return-oriented programming (ROP) gadgets. What is the likely purpose of this payload?
ROP is a code-reuse exploitation technique.
Why this answer
ROP gadgets are used to bypass non-executable memory protections by chaining together small code sequences to execute arbitrary code. This is an exploitation technique.
An analyst detects an attack where the attacker uses NTLM authentication with a hashed password instead of the plaintext password. This technique is known as:
Correct. Pass-the-hash uses the NTLM hash for authentication.
Why this answer
Pass-the-hash allows an attacker to authenticate using the hash of a password without knowing the actual password.
An analyst identifies an alert for 'ET TROJAN Win32/DarkComet RAT Beacon'. The analyst confirms the host is infected. Which TWO phases of the Cyber Kill Chain have been completed prior to this C2 beacon? (Choose two.)
Exploitation allowed the malware to run.
Why this answer
For C2 to occur, the attacker must have delivered the malware and exploited a vulnerability to install it.
In a PCAP, an analyst sees a large outbound data transfer over FTP to an external IP address during non-business hours. The source host is a database server. Which phase of the Cyber Kill Chain does this represent?
Exfiltration is an action on objectives.
Why this answer
The Cyber Kill Chain's 'Actions on Objectives' phase is where the attacker achieves their ultimate goal, such as exfiltrating data. In this scenario, a large outbound FTP transfer from a database server to an external IP during non-business hours directly indicates data theft, which is the final objective of the intrusion. FTP (port 21/20) is used here as the exfiltration protocol, moving sensitive data out of the network.
Exam trap
Cisco often tests the distinction between 'Actions on Objectives' and 'Exploitation' by presenting a post-compromise activity (like data exfiltration) and expecting candidates to recognize it as the final phase, not the initial breach.
How to eliminate wrong answers
Option A is wrong because 'Installation' refers to deploying malware or a backdoor on the target system, not to the actual data exfiltration seen here. Option C is wrong because 'Weaponization' is the phase where the attacker creates a deliverable payload (e.g., coupling an exploit with a dropper), which occurs before delivery and exploitation. Option D is wrong because 'Exploitation' is the phase where a vulnerability is triggered to gain initial access, not the post-compromise data theft activity.
In the Cyber Kill Chain, which TWO phases occur after the attacker establishes command and control (C2)?
Lateral movement can occur after C2 to reach more systems.
Why this answer
After establishing command and control (C2), the attacker typically performs lateral movement to pivot within the network and then executes actions on objectives, such as data exfiltration or system disruption. In the Cyber Kill Chain, the phases following C2 are lateral movement and actions on objectives, as the attacker uses the C2 channel to explore the environment and achieve their end goal.
Exam trap
Cisco often tests the order of the Cyber Kill Chain phases, and the trap here is confusing 'installation' (which occurs before C2) with 'lateral movement' (which occurs after C2), leading candidates to incorrectly select installation as a post-C2 phase.
A network analyst finds a PCAP with a series of DNS queries for subdomains like "data12345.example.com" and "data67890.example.com" where the subdomain names appear to contain encoded base64 data. This pattern suggests:
Encoding data in subdomains for exfiltration is DNS tunnelling.
Why this answer
DNS exfiltration encodes data in subdomain names to bypass security controls, as DNS is often allowed through firewalls.
An analyst receives an alert for 'ET WEB_SERVER Possible SQL Injection Attempt' triggered by a URL parameter containing ' OR 1=1--'. After investigating, the analyst confirms that the web application is not vulnerable to SQL injection and the request was a benign test. How should this alert be classified?
The alert triggered but no attack occurred, so false positive.
Why this answer
The alert triggered but there was no actual attack, so it is a false positive.
An analyst is investigating a PCAP file and wants to reconstruct a conversation between two hosts. Which Wireshark filter would be most appropriate to follow the entire TCP stream?
Correct. tcp.stream reconstructs the TCP stream.
Why this answer
The 'tcp.stream' filter allows the analyst to follow and reconstruct the full TCP conversation.
In a PCAP, an analyst sees an interactive shell session over TCP with irregular command prompts and responses. Which tool was likely used to generate this traffic?
Interactive shell over TCP is characteristic of a reverse shell.
Why this answer
Reverse shells create interactive shell sessions over a TCP connection, often used by attackers to control compromised hosts.
During a PCAP analysis, a security analyst notices an HTTP request with the URI parameter 'id=1 UNION SELECT username,password FROM users--'. What is the most likely attack being attempted?
UNION SELECT is a classic SQL injection technique to combine query results.
Why this answer
The presence of UNION and SELECT keywords in a URL parameter indicates a SQL injection attempt, where the attacker tries to extract data from a database.
During alert triage, an analyst determines that an alert was triggered by legitimate administrative activity. How should this alert be classified?
Correct. Legitimate activity causing an alert is a false positive.
Why this answer
A false positive is when an alert is triggered but no actual attack occurred.
In the MITRE ATT&CK framework, TTPs are mapped to:
Correct. TTPs are associated with specific groups.
Why this answer
MITRE ATT&CK maps adversary tactics, techniques, and procedures to real-world threat groups.
An analyst observes repeated TCP SYN packets to various ports on a target IP with no SYN-ACK responses. What type of scan is most likely being performed?
Correct. SYN scan sends SYN packets and does not complete the handshake.
Why this answer
A SYN scan sends SYN packets and observes responses; incomplete handshakes indicate scanning.
During an intrusion analysis, an analyst identifies that an attacker used a domain generation algorithm (DGA) to resolve C2 domains. Which of the following traffic patterns is most consistent with DGA?
DGA generates many domains, most of which don't exist, causing NXDOMAIN.
Why this answer
DGA generates many random-looking domains, many of which will be non-existent (NXDOMAIN) as the attacker cycles through them.
An analyst observes a large outbound FTP transfer to an external IP address from a server that normally does not generate such traffic. This is most likely an indicator of:
Correct. Large outbound transfers are a key exfiltration indicator.
Why this answer
Data exfiltration often involves large transfers to external destinations not typical for the host.
During a SYN scan, an attacker sends a SYN packet to a closed port on a target. What response does the target typically send back?
Closed ports respond with RST.
Why this answer
In a SYN scan, a closed port responds with a RST packet to reject the connection attempt.
In the Cyber Kill Chain model, which phase involves delivering the exploit to the target, such as via email attachment or malicious link?
Correct. Delivery is the transmission of the weaponized payload.
Why this answer
The delivery phase is where the weaponized payload is transmitted to the victim, e.g., via phishing email or drive-by download.
Interactive shell over TCP is a reverse shell.
Why this answer
A web shell allows remote command execution over HTTP, essentially a reverse shell.
An analyst analyzing a PCAP sees a series of TCP connections where the client sends data with interactive patterns and receives commands. This is most likely indicative of:
Correct. Interactive shell sessions over TCP indicate a reverse shell.
Why this answer
A reverse shell provides an interactive command-line session from the victim to the attacker.
An intrusion detection system alerts on traffic that appears to be a command and control (C2) beacon. Which of the following characteristics is most typical of beaconing traffic?
Regular intervals are a hallmark of beaconing for C2.
Why this answer
Beaconing is characterized by regular, periodic connections to a C2 server at consistent intervals.
An analyst is monitoring network traffic and observes a host making outbound HTTPS connections to a domain that appears to be generated by a Domain Generation Algorithm (DGA). Which phase of the Cyber Kill Chain best describes this activity?
Correct. DGA domains are used to locate C2 servers.
Why this answer
After installation, the malware contacts C2 servers to receive commands. DGA domains are used for C2 communication.
Which type of attack is indicated by a series of SMB authentication attempts from one host to multiple other hosts in a short time frame?
SMB authentication attempts across hosts is typical of lateral movement.
Why this answer
Lateral movement often involves propagating across hosts using SMB for remote access and authentication.
An analyst captures traffic and sees a TCP connection with only a SYN packet and an RST response. No SYN-ACK is observed. Which scan technique is this?
SYN scan uses SYN packets, and RST indicates closed port.
Why this answer
A SYN scan sends a SYN and expects a SYN-ACK; if an RST is received, the port is closed. Incomplete handshake without SYN-ACK indicates a half-open scan.
An analyst detects a large outbound FTP transfer from a sensitive server to an external IP address not previously seen. The file being transferred is a compressed archive containing database dumps. Which Cyber Kill Chain phase is most directly indicated?
Exfiltration of data is a key objective in many attacks.
Why this answer
Exfiltration of sensitive data is part of 'Actions on Objectives', where the attacker achieves their goal of stealing data.
An analyst is investigating a host that is making outbound HTTPS connections to multiple random-looking domains, each with a short TTL. The domains are not in any threat intelligence feeds. Which technique is most likely being used?
Correct. DGA generates random domains for C2.
Why this answer
Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. Short TTLs allow fast changes.
A network analyst is investigating a suspected DNS tunneling attack. Which THREE of the following are indicators of DNS tunneling?
High query volume can indicate data exfiltration via DNS.
Why this answer
DNS tunneling often involves high volumes of DNS queries to a single domain, large payloads in TXT records, and encoded data in subdomains to exfiltrate data.
In Wireshark, which filter can be used to quickly find all HTTP requests that contain a specific keyword in the URL?
This filter matches HTTP request URIs containing the keyword.
Why this answer
The http.request filter combined with a contains operator can isolate HTTP requests with specific patterns.
Ready to test yourself?
Try a timed practice session using only Cbrops Intrusion Analysis questions.