Security Monitoring practice questions

ARP spoofing

Why wrong: ARP spoofing involves falsified ARP messages, not TCP SYN packets.

DNS amplification attack

Why wrong: DNS amplification uses DNS responses with large payloads, not SYN packets.

ICMP flood attack

Why wrong: ICMP flood uses ICMP Echo Request packets, not TCP SYN.

alert tcp $HOME_NET any -> any 21

Why wrong: This would alert on FTP traffic from internal IPs, the opposite of what is needed.

alert tcp any any -> any 21

Why wrong: This rule alerts on all FTP traffic, not just from external sources.

alert udp any any -> any 21

Why wrong: FTP uses TCP, not UDP.

Denial of service attack

Why wrong: DoS attacks generate high traffic but typically to many destinations or with specific patterns, not a single external IP with large data uploads.

Port scan activity

Why wrong: Port scans involve connections to many ports on many hosts, not large data transfers.

Normal web browsing traffic

Why wrong: The volume is far above the host's baseline; normal browsing would not produce such a spike.

A DNS query was made from an internal host to an external server.

Why wrong: The protocol is TCP and port is 445 (SMB), not DNS (UDP 53).

An external host attempted to access an internal SMB server on port 445 and was blocked.

Why wrong: The source IP is internal (10.0.0.5), not external.

An internal host successfully connected to an external server on port 445.

Why wrong: The action is DENY, so the connection was blocked.

SQL injection

Why wrong: SQL injection would show SQL syntax in parameters, not just repeated username attempts.

Cross-site scripting (XSS)

Why wrong: XSS involves injecting scripts into output, not multiple login attempts.

Directory traversal

Why wrong: Directory traversal uses ../ patterns in URL, not login attempts.

Alert when a single failed SSH login occurs.

Why wrong: A single failure could be a typo; it's not indicative of an attack.

Alert when successful SSH logins occur outside business hours.

Why wrong: This is a non-standard activity but not specifically brute force.

Alert when multiple failed SSH logins from various IPs occur in one hour.

Why wrong: This could be a distributed attack, but the rule should focus on a single source typically.

Data was transferred successfully and the connection closed normally.

Why wrong: That would be state SF (normal close).

The connection was established successfully.

Why wrong: Established connections would have a state like SF (normal close) or OTH (other).

The connection was reset by the remote host.

Why wrong: Reset connections show state 'RST'.

Check the host's web browsing history for suspicious websites.

Why wrong: This action is less immediate and can be done after containment.

Immediately block the destination IP on the firewall.

Why wrong: Blocking the destination IP may disrupt the attack but does not address the compromised host. Isolation is more urgent.

Ignore the alert because the traffic is encrypted over port 443.

Why wrong: Encryption does not mean the traffic is safe; Zeus can use HTTPS for command and control.

http.request.uri contains "password"

Why wrong: This only checks the URI, not the full payload (e.g., POST data).

data contains "password"

Why wrong: The 'data' filter looks at raw data, but not specifically HTTP packets.

tcp.port == 80 and frame contains "password"

Why wrong: This filter checks the entire frame, not just HTTP payload, and may include false positives.

An invalid hash; the file may be corrupt.

Why wrong: The hash is valid but corresponds to an empty file.

A known malicious executable that should be quarantined.

Why wrong: This hash is actually the hash of an empty file, not a known malware.

A hash of a benign system file.

Why wrong: It is not a system file; it's an empty file.

SQL injection

Why wrong: SQL injection would typically show SQL syntax like 'SELECT' or 'UNION'.

Directory traversal

Why wrong: Directory traversal uses '../' patterns, not command execution.

Cross-site scripting (XSS)

Why wrong: XSS would contain script tags like <script>.

Disable the signature entirely.

Why wrong: Disabling may leave the network exposed to real attacks matching that signature.

Increase the severity of the signature to get more attention.

Why wrong: This would worsen the false positive problem, not solve it.

Change the signature action to 'alert' instead of 'drop'.

Why wrong: This does not address the false positive rate; it just changes the action.

DNS responses with a large number of IP addresses

Why wrong: This could indicate DNS amplification, not exfiltration.

DNS queries for AAAA records (IPv6) from an IPv4-only network

Why wrong: This is unusual but not a strong indicator of exfiltration.

DNS query responses with high TTL values

Why wrong: TTL values are not typically associated with data exfiltration; they affect caching.

Investigate alerts in the order they were received.

Why wrong: This is inefficient; priority should be based on risk, not chronological order.

Automatically close all low-severity alerts without review.

Why wrong: Low-severity alerts can still indicate lateral movement or recon; they should be reviewed periodically.

The current time of day

Why wrong: Time of day is not an IoC.

The company's stock price

Why wrong: Stock price is unrelated to technical security monitoring.

The number of employees in the company

Why wrong: This is organizational data, not a technical indicator of compromise.

HTTPS

Why wrong: HTTPS uses port 443.

DNS

Why wrong: DNS uses port 53.

HTTP

Why wrong: HTTP uses port 80.

Alert on a single failed login from any IP

Why wrong: A single failure is not indicative of a brute force attack.

Alert when a successful login occurs after midnight

Why wrong: This may be suspicious but is not specific to brute force.

Alert when a user logs in from a new geographic location

Why wrong: This indicates possible account takeover but not necessarily brute force.

Protocol filter

Why wrong: Protocol filters are a subset of display filters but not the specific type for string search.

Capture filter

Why wrong: Capture filters are applied before capture and cannot filter by packet content strings.

BPF filter

Why wrong: BPF filters are used for capture, not display.

DNS amplification attack

Why wrong: DNS amplification involves large response sizes, not random subdomains.

DNS cache poisoning

Why wrong: Cache poisoning involves corrupting DNS resolver cache, not random subdomains.

Normal DNS resolution for a legitimate service

Why wrong: Legitimate DNS queries typically have meaningful subdomains.

Application layer

Why wrong: The Application layer handles user-facing protocols.

Transport layer

Why wrong: The Transport layer handles ports and segmentation.

Data Link layer

Why wrong: The Data Link layer handles MAC addresses, not IP.