CCNA Cbrops Security Monitoring Questions

IP addresses are network-layer artefacts recorded in firewall, IDS and proxy logs, letting analysts block or correlate malicious hosts. They satisfy the IoC requirement because they are observable, machine-readable evidence that a compromise may have occurred.

Large outbound transfers from one internal host to an external IP outside business hours, far exceeding baseline, match data exfiltration behaviour. NetFlow records volume and direction, not payload, so the anomaly itself signals possible data theft rather than scanning or denial of service, which produce different traffic patterns.

Thresholding failed SSH logins by source IP within a one-minute window captures the high-frequency, single-origin pattern characteristic of brute forcing, while the short window and IP grouping suppress unrelated sporadic failures. This matches the stem's SSH brute force scenario.

NetFlow alone shows only metadata; correlating timestamps with DNS logs and endpoint telemetry reveals the process responsible and whether it resolves a suspicious domain. This combination is the most reliable way to confirm beaconing behavior and identify the malware family or C2 infrastructure.

An outbound connection to a known malicious domain from a user who just clicked a phishing link is a strong compromise signal regardless of current endpoint findings. Early malware often leaves little on disk. Isolating preserves evidence, memory capture may reveal injected code or in-memory payloads, and correlating timing with the email establishes the intrusion chain before lateral movement or credential theft occurs.

HTTP, FTP and SMTP are application-layer protocols operating at Layer 7, where they exchange user-facing data and commands. Application-layer attacks such as injection and cross-site scripting exploit these protocols directly, making Layer 7 the correct association.

Windows Security event logs record logon and authentication events, including network logons to remote shares. On the workstation, events such as 4624 with logon type 3 indicate a network logon to a server share. This log source directly shows the authentication attempt and its outcome, making it the most relevant place to check.

Display filters in Wireshark operate on captured packets already in memory, letting analysts match payload strings such as 'password' using expressions like frame contains. Capture filters apply earlier via BPF syntax and cannot search arbitrary payload text, so they cannot satisfy this requirement.

Numerous failed authentications from one IP within a minute reflect automated credential guessing, the signature of a brute-force attack. The rule's source-IP and time-window constraints detect this volume pattern rather than isolated failures or distributed attempts.

One internal host contacting many external addresses on port 445 indicates SMB scanning or worm propagation seeking vulnerable shares. The fan-out pattern and SMB port distinguish it from normal file sharing, satisfying the stem's NetFlow scenario.

Full packet capture with content inspection can reveal the actual payload, file types, and protocols involved in the transfer, confirming whether sensitive data is leaving the network. NetFlow alone shows volume and endpoints but not content. Capturing and inspecting the traffic, or using proxy and TLS inspection logs where decryption is possible, provides the definitive evidence needed to confirm exfiltration.

Periodic, low-volume fan-out to many distinct external hosts on a single common port is a classic beaconing signature, especially outside business hours. Because NetFlow records only metadata, the analyst cannot see payload, so the correct next step is to correlate the flows with endpoint telemetry and DNS logs before concluding compromise, but escalation is warranted.

DNS tunneling frequently uses TXT records because they can carry arbitrary data and are often permitted through firewalls. Long base64-encoded strings in TXT responses indicate that the DNS channel is transporting encoded payloads, which is a strong signal of command-and-control or exfiltration. Combined with the random subdomain pattern, this artifact directly confirms that data is being moved over DNS rather than merely resolved. Legitimate TXT records, such as SPF or DKIM, have structured formats and predictable lengths.

System authentication logs record login attempts against the underlying operating system, revealing repeated failed credential submissions from a single source. Correlating these timestamps with web activity exposes brute-force patterns targeting application accounts, satisfying the stem's requirement to identify the attack across multiple log sources.

More than ten failed logins from one source IP within a minute is rapid, repeated authentication failure, the defining pattern of brute-force attacks. The threshold and time window distinguish it from occasional user error or password spraying across many accounts.

Zeek's file extraction framework reconstructs files from HTTP sessions by reassembling stream data and writing payloads to disk, satisfying the requirement to extract transferred files from captured traffic. It handles MIME types and connection tracking natively, so no packet-level manual carving is needed.

A file hash such as MD5 is a concrete, machine-checkable artefact uniquely identifying known malicious files, making it a valid IoC. It satisfies the indicator requirement because hashes are observable, shareable and directly matchable against endpoint or sandbox telemetry.

A high volume of DNS queries to one unusual domain signals tunnelling, where data is encoded into query names and smuggled out through the resolver. This satisfies the stem's DNS-based exfiltration indicator, since legitimate DNS traffic rarely concentrates on a single unfamiliar domain at volume.

Sysinternals strings.exe is a widely used tool that extracts ASCII and Unicode strings from binary files. Running it from Command Prompt and searching for domain patterns is a standard, effective method for initial triage of a suspicious executable on Windows.

Signatures with the 'OS-COMMAND' prefix in Cisco Firepower/SNORT rule sets are designed to detect attempts to execute operating system commands through an application, commonly via web request parameters. The traffic targeting port 80 on a web server strongly supports a command injection attempt, where an attacker tries to pass shell commands through an HTTP request to gain execution on the host.

Volatile data such as active sockets, process listings, and loaded modules exists only while the system runs, so it must be captured first and written to external media to avoid altering the disk. Order of volatility dictates collecting the most perishable evidence earliest. Documenting the commands and timestamps maintains forensic integrity and supports later analysis.

The -Y flag applies a Wireshark display filter, which restricts which decoded packets tshark prints without altering what was captured. Capture filters, by contrast, use BPF syntax and discard traffic at collection time, so they cannot be applied to an already-saved pcap.

TCP operates at Layer 4, where SYN floods exhaust the connection table by sending numerous half-open handshakes. The attack targets the transport-layer three-way handshake mechanism itself, so Layer 4 is the precise target rather than the application payload or network routing.

Fifty failed attempts followed by a success from the same IP indicates the attacker eventually guessed valid credentials, confirming a successful brute force. The preceding failures supply the attack signature, while the success shows compromise, making this entry highly suspicious.

DGA malware generates large volumes of pseudo-random subdomain queries, most of which fail because only a few are pre-registered by the attacker. The NXDOMAIN responses for random subdomains under one domain precisely match this rendezvous technique.

A single host pushing 4.2 GB to one external address in 40 minutes, hundreds of times above its own baseline, matches bulk outbound transfer behavior. The missing proxy log means the session did not traverse the inspected path, so content was likely TLS-encrypted and uninspected. NetFlow alone cannot prove exfiltration, but it strongly supports this hypothesis and warrants escalation.

The attack is defined by httpd spawning bash with a reverse shell command line, which endpoint telemetry captures directly. Monitoring process lineage and command-line arguments detects this pattern regardless of the destination IP or port, making it robust against infrastructure changes. This technique also generalizes to similar web shell and reverse shell abuses across the environment.

SNMP traps are unsolicited notifications pushed by agents to a manager, so the manager must listen on a dedicated port rather than the agent's UDP 161. UDP 162 satisfies this scenario's requirement for receiving traps, since trap delivery is fire-and-forget over UDP with no acknowledgement or session setup.

A flow to an IP listed in threat intelligence links internal traffic to known malicious infrastructure, a strong exfiltration indicator. Unlike volume alone, this reputation match ties the connection to adversary-controlled endpoints, satisfying the requirement for corroborating evidence of compromise.

Bytes transferred quantifies the actual data volume moved between endpoints, directly exposing abnormally large outbound transfers to external addresses. Flow counts or packet totals alone cannot reveal payload size, so this metric best satisfies the stem's requirement to identify bulk exfiltration.

A workstation receiving inbound RDP connections from multiple external IPs is highly suspicious because workstations should not expose RDP to the internet. The analyst should first investigate the endpoint to confirm whether an attacker has enabled RDP or installed a backdoor, gather evidence, and then contain the incident appropriately.

A SHA-256 hash is a cryptographic file fingerprint, so matching it to a known indicator identifies the artefact itself rather than network behaviour or infrastructure. This satisfies the stem's constraint: the IoC derives from the extracted file's content, making it file-based rather than network- or host-based.

DNS tunnelling encodes stolen data within query and response records, so DNS logs capture the queried names, record types, sizes and frequencies needed to spot anomalous exfiltration patterns. They directly satisfy the requirement to confirm data leaving via DNS.

An MD5 hash uniquely identifies a known malicious file, so matching it against endpoint or network telemetry flags that exact executable without ambiguity. This satisfies the stem's requirement for a concrete, observable artefact left behind by an intrusion, unlike behavioural baselines or policy configurations, which describe normal states rather than evidence of compromise.

Average bandwidth usage over time establishes the quantitative normal for link utilisation, so deviations such as spikes or sustained increases become detectable. This metric underpins anomaly-based monitoring, satisfying the baseline requirement for measurable traffic volume.

The ASCII bytes 'MZ' (0x4D5A) form the DOS header signature at offset zero of every Windows PE file, so a YARA rule matching 'MZ' at the start of a file identifies Windows executables. This satisfies the scenario's need to flag executable files by their magic number.

Unauthorized outbound SSH from a workstation to multiple external IPs is a strong indicator of malware using SSH for command and control or data exfiltration. Attackers often use SSH to blend in with legitimate traffic or to create encrypted tunnels.

Process Create captures the executable path, full command line, user, hashes, and parent process identifier, which together reveal suspicious invocations such as encoded PowerShell or an unexpected child of a document reader. It is the primary Sysmon event for identifying malicious execution and building process lineage during triage, so it belongs in the first correlation step.

Message 106023 indicates that a packet was denied by an ACL, and the destination port 443 with an expected inbound service strongly suggests a misconfigured or overly restrictive ACL. The analyst should review the interface ACL and any object group references to confirm whether the web server's public address is permitted. If the server is meant to receive HTTPS from the internet, the denial represents an availability issue rather than an attack, and the ACL must be corrected.

Cisco Threat Grid is a malware analysis and threat intelligence platform that allows analysts to submit files or hashes to obtain a threat score and behavioral analysis. It provides detailed reports on file reputation, making it the appropriate tool for this scenario.

Correlating the events by source and destination IP reveals the pattern behind the alerts. Hundreds of alerts to the same external IP across different ports strongly suggest scanning or sweep behavior rather than a single exploit, which guides escalation decisions and helps the analyst avoid treating each alert as an isolated incident.

Attackers commonly name malicious binaries svchost.exe or inject into the real process to evade casual inspection. The decisive evidence is the parent process: genuine svchost.exe is spawned by services.exe, so a cmd.exe parent indicates process masquerading or injection. The connection to port 4444, a frequent C2 and reverse-shell port, further supports malicious command-and-control activity requiring immediate investigation.

Repeated DNS queries to a known malicious domain indicate command-and-control or DNS-tunnelling exfiltration, where stolen data is encoded into query names. The known-malicious reputation plus frequency satisfies the exfiltration indicator requirement, unlike ordinary name resolution.

Web server logs record each HTTP request, capturing the method (GET, POST), status code and User-Agent header, so they directly satisfy the stem's requirement for those three fields. Other log types, such as firewall or authentication logs, lack this application-layer detail.

Port 445 is SMB, and the DENY action confirms the firewall dropped the session. The log shows an internal host (10.0.0.5) initiating TCP/445 toward an external address, so the outbound SMB connection attempt was blocked.

DGA malware generates many domains, most of which are not registered, resulting in NXDOMAIN responses. A spike in NXDOMAIN for long, random-looking names is a classic DGA indicator, as the malware probes many candidates before finding an active C2 domain.

The combination of SMB port 445 and a command shell payload like 'cmd.exe /c whoami' strongly suggests an attacker using SMB for lateral movement and executing commands on a remote system. This is a common technique in ransomware and APT campaigns, where SMB is used to propagate and run commands.

Security event IDs 4624 and 4625 capture successful and failed logons with fields such as Logon Type and Source Network Address, which directly expose network authentication attempts against the server. Logon Type 3 indicates a network logon such as SMB, making this the most direct evidence of credential use against the file server in the scenario.

NetFlow records include source/destination IP, ports, protocol, and byte/packet counts. To identify large outbound transfers, the destination IP and byte count are critical. An unusual external host receiving a high volume of bytes from an internal host suggests exfiltration. Other fields like source port or TCP flags are less directly indicative of data volume.

Large outbound POST requests at regular intervals suggest automated data transfer to an external host. Legitimate user browsing rarely produces consistent, large uploads on a schedule. This pattern is consistent with exfiltration tools that beacon or upload data in chunks, making it a suspicious indicator worth investigating.

A single host transferring 10 GB externally within an hour, vastly exceeding its 100 MB daily baseline, indicates bulk data movement outbound. This volume anomaly, visible in NetFlow byte counters, is characteristic of data exfiltration rather than normal business traffic or routine backup activity.

Zeek's S0 state records a connection attempt where the originator sent a SYN but received no SYN-ACK, so the handshake never completed. This matches the stem's unanswered SYN, distinguishing it from established (SF) or reset (RST) states.

Zeek's http.log records HTTP request metadata including the Host header and URI, so requests to a known malicious domain are directly visible there. conn.log lacks application-layer detail, and dns.log only captures name resolution, not the subsequent HTTP request itself.

Requesting the same path with .php, .html, then .asp extensions, mostly returning 404, shows systematic enumeration of login page filenames. The attacker is probing for valid login page paths rather than exploiting a known vulnerability.

Correlating NetFlow records with DNS logs links the external IP to a domain, which can then be checked against threat intelligence. This confirms whether the destination is a known C2 server. Short-lived connections with varying ports are typical of beaconing, and identifying the domain helps validate the suspicion, making this the most effective approach.

A web server accepting HTTPS connections legitimately receives many TCP SYN packets to port 443 as clients initiate TLS handshakes. This high connection-initiation volume is expected baseline behaviour during business hours, distinguishing normal client demand from anomalies such as scanning or denial-of-service floods.

FTP transmits credentials in cleartext over TCP, so a followed stream exposes usernames and passwords directly. Unlike FTPS or SFTP, which negotiate TLS or SSH encryption before authentication, plain FTP offers no confidentiality, matching the plaintext credentials observed in the capture.

Beaconing is identified by repeated connections at regular intervals with near-constant payload sizes, which distinguishes it from bursty or variable user-driven traffic. Stealthwatch's flow records preserve timestamps and byte counts, so plotting inter-arrival times and sizes exposes the 60-second cadence. Correlating that pattern with the newly registered domain strengthens the characterization of automated C2 beaconing rather than normal application behavior.

Many outbound connections to diverse external hosts on port 25, with tiny payloads, indicate SMTP scanning or spam relay activity. A legitimate mail server contacts few destinations with larger message bodies; this fan-out pattern from one internal host satisfies the stem's high-connection, small-payload constraint.

TCP SYN packets to many ports on one host from a single source form the classic half-open scan pattern: the attacker sends SYNs without completing handshakes, seeking open ports. This fan-out to numerous ports on a single target distinguishes scanning from normal connection attempts.

Counting failed logins per source IP within one minute detects the rapid, repeated authentication attempts from one origin that define brute forcing, filtering out isolated failures. This logic directly identifies the activity the analyst is investigating.

Repeated authentication failures from one source within a short window match the brute force pattern, where an attacker rapidly guesses credentials against a single account or host. The rule's thresholds — more than 10 attempts in 60 seconds from the same IP — directly encode that volume-based signature.

DGAs generate many random domain names that malware queries to locate its C2 server. The high volume of non-resolving queries to random domains is a classic sign of DGA activity. Cisco Umbrella would log these queries, and the pattern of random, unresolvable domains strongly indicates malware attempting to establish C2 communication.

NetFlow volume counters directly quantify how much data left the internal host toward the command-and-control address. A large, sustained outbound byte count relative to the host's normal baseline is the most direct flow-level indicator that data was actually transferred rather than merely attempted. This makes it the strongest evidence of successful exfiltration among the available telemetry sources.

Repeated failed logons for one account followed by success is the signature of a brute-force attack, where an attacker systematically guesses credentials until one works. The volume within a short window distinguishes it from isolated user error.

Port 3389 is used by Microsoft Remote Desktop Protocol (RDP). Repeated inbound connection attempts from multiple external IPs to this port indicate an attempt to gain unauthorized access, often through brute-force or password spraying. The fact that the connections are denied means the firewall is blocking them, but the pattern is characteristic of an RDP brute-force attack.

To reconstruct complete TCP sessions, the sensor needs to see packets flowing in both directions. If only one direction is mirrored, the sensor sees half-conversations, which degrades detection and can prevent session reassembly. Configuring the source interface to capture both ingress and egress traffic is therefore the essential requirement for this deployment.

A SYN flood exploits the TCP three-way handshake by sending repeated SYN packets without completing the connection, exhausting the backlog of half-open connections. This handshake operates at the Transport Layer (Layer 4), so that layer is the attack's direct target.

FireSIGHT (now integrated into Cisco Firepower) correlates intrusion events with host vulnerability data to provide impact flags and contextual information. This helps analysts understand the severity and potential impact of an attack by mapping it to known vulnerabilities on the target host.

Sustained outbound transfer over port 443 to one external address, at ten times the peer baseline, indicates data leaving the network. Port 443 is commonly abused to blend with HTTPS traffic, and the volume deviation from other hosts satisfies the anomaly constraint in the stem.

SSH encrypts the entire session, including credentials and commands, unlike Telnet on port 23, which transmits everything in cleartext. Port 22 is SSH's registered port, so it satisfies the requirement for secure remote administration of network devices.

SMB scanning matches the record precisely: port 445 is SMB, and one internal host contacting many external IPs within seconds indicates horizontal sweeps seeking exposed file shares. The high fan-out and short timeframe satisfy the stem's beaconing-free, rapid connection pattern, distinguishing it from single-target exploitation or data transfer.

Web server access logs record each request's method, URI, status code, and user-agent, making them the primary source for spotting exploitation attempts such as SQL injection, path traversal, or command injection in request parameters. They reveal the initial attack vector and timing, which anchors the rest of the investigation. Correlating these entries with endpoint activity identifies the exploited process and any spawned child processes.

Rapid, widespread writes to numerous network file shares from one account is consistent with a ransomware binary encrypting shared data after initial execution. This pattern distinguishes encryption activity from normal user file access, which is typically limited in scope. Combined with suspicious script execution, it provides strong corroboration of an active or imminent ransomware incident.

RDP listens on TCP port 3389 by default, so this directly satisfies the stem's requirement. Attackers repeatedly target 3389 with brute force credential attempts because exposed RDP endpoints accept authentication requests, making weak passwords exploitable. Restricting access via Microsoft Entra ID conditional access or a VPN mitigates this exposure.