Scenario practice questions

A
The access-group 'OUTSIDE_IN' permitted the traffic.
Why wrong: Deny indicates blocked.
B
An internal host attempted to connect to an external web server.
Why wrong: Source is outside, destination is inside.
C
An external host attempted to connect to an internal web server and was blocked.
Matches the deny action and direction.
D
The ASA allowed the connection because it is a stateful firewall.
Why wrong: Log says 'Deny'.

Question 2easymultiple choice

An analyst notices that a host is sending large amounts of data to an external IP address on TCP port 22 during non-business hours. What is the most likely activity?

Trap 1: Remote administration

Remote administration is legitimate but the timing and volume suggest exfiltration.

Trap 2: DNS query

DNS uses port 53.

Trap 3: FTP file transfer

FTP uses port 21, not 22.

A
Remote administration
Why wrong: Remote administration is legitimate but the timing and volume suggest exfiltration.
B
DNS query
Why wrong: DNS uses port 53.
C
FTP file transfer
Why wrong: FTP uses port 21, not 22.
D
Data exfiltration via SSH
SSH on port 22 can be used to tunnel data out.

Read the full NAT/PAT explanation →

Question 3hardmultiple choice

Refer to the exhibit. An analyst sees these log messages on a Cisco router. The source IP 10.0.0.2 is an internal server. What is the most likely explanation?

Exhibit

Refer to the exhibit.

! Output from show logging on Cisco IOS router
Mar  1 10:00:00: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12345) -> 192.168.1.1(80), 1 packet
Mar  1 10:00:01: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12346) -> 192.168.1.1(80), 1 packet
Mar  1 10:00:02: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12347) -> 192.168.1.1(80), 1 packet
Mar  1 10:00:03: %SEC-6-IPACCESSLOGP: list INBOUND denied tcp 10.0.0.2(12348) -> 192.168.1.1(80), 1 packet

Trap 1: An external host is scanning the router.

Source is internal IP 10.0.0.2.

Trap 2: The router is under a brute-force attack on the HTTP server.

The logs show denied packets, not multiple authentication attempts.

Trap 3: The router is infected with malware and generating traffic.

The traffic is from the server, not the router.

A
An external host is scanning the router.
Why wrong: Source is internal IP 10.0.0.2.
B
The router is under a brute-force attack on the HTTP server.
Why wrong: The logs show denied packets, not multiple authentication attempts.
C
The internal server is trying to access the router's web interface, which is blocked by an ACL.
The router's own IP is being targeted on HTTP; this is likely management access.
D
The router is infected with malware and generating traffic.
Why wrong: The traffic is from the server, not the router.

Read the full network assurance explanation →

Question 4mediummultiple choice

An analyst reviews the Cisco ASA syslog message shown in the exhibit. What does this entry indicate?

Exhibit

Refer to the exhibit.
%ASA-4-106023: Deny tcp src outside:203.0.113.45/56789 dst inside:10.1.1.100/80 by access-group "outside_in"

Trap 1: A successful HTTP connection from the outside to the inside server

The message clearly states "Deny", not "Permit".

Trap 2: A VPN tunnel initiation that was rejected due to authentication…

There is no indication of VPN or authentication in the message.

Trap 3: A NAT translation failure for an outbound connection

The source is outside and destination inside, indicating an inbound connection; no NAT failure is mentioned.

A
A successful HTTP connection from the outside to the inside server
Why wrong: The message clearly states "Deny", not "Permit".
B
A VPN tunnel initiation that was rejected due to authentication failure
Why wrong: There is no indication of VPN or authentication in the message.
C
An attempted connection from an external host to an internal web server that was blocked by the firewall
Correctly describes the denied inbound TCP connection to port 80.
D
A NAT translation failure for an outbound connection
Why wrong: The source is outside and destination inside, indicating an inbound connection; no NAT failure is mentioned.

Question 5mediummultiple choice

A help desk receives a phone call from someone claiming to be from IT and requesting a password reset. What type of attack is this?

Trap 1: Social engineering

Social engineering is a broader category; the specific attack here is vishing.

Trap 2: Phishing

Phishing is usually via email or messages, not phone calls.

Trap 3: Malware

Malware involves malicious software, not phone calls.

A
Social engineering
Why wrong: Social engineering is a broader category; the specific attack here is vishing.
B
Phishing
Why wrong: Phishing is usually via email or messages, not phone calls.
C
Malware
Why wrong: Malware involves malicious software, not phone calls.
D
Vishing
Vishing is voice phishing conducted over phone calls.

Question 6mediummultiple choice

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a server is sending encrypted data to an external IP address during non-business hours. The server is supposed to only communicate with internal systems. What is the best immediate action?

Trap 1: Block the external IP address at the firewall

Blocking the IP may stop exfiltration but does not address the root cause or prevent other exfiltration methods.

Trap 2: Notify the server's administrator

Notification is important but should not delay containment; the immediate action is to disconnect.

Trap 3: Capture a packet capture (PCAP) of the traffic for analysis

PCAP is useful for analysis but is not an immediate containment action; data continues to be exfiltrated.

A
Disconnect the server from the network
This immediately stops data transfer, preserving evidence and preventing further loss.
B
Block the external IP address at the firewall
Why wrong: Blocking the IP may stop exfiltration but does not address the root cause or prevent other exfiltration methods.
C
Notify the server's administrator
Why wrong: Notification is important but should not delay containment; the immediate action is to disconnect.
D
Capture a packet capture (PCAP) of the traffic for analysis
Why wrong: PCAP is useful for analysis but is not an immediate containment action; data continues to be exfiltrated.

Question 7easymultiple choice

An analyst is monitoring network traffic and sees a sudden spike in outbound data transfer from an internal server to an external IP that is known to be malicious. What is the most likely scenario?

Trap 1: Software update.

Updates typically come from official vendors, not malicious IPs.

Trap 2: User downloading a large file.

Downloads are inbound, not outbound data transfer.

Trap 3: Normal backup operation.

Backups usually go to internal or trusted cloud services, not known malicious IPs.

A
Software update.
Why wrong: Updates typically come from official vendors, not malicious IPs.
B
Data exfiltration.
Data exfiltration involves sending sensitive data to an attacker-controlled IP.
C
User downloading a large file.
Why wrong: Downloads are inbound, not outbound data transfer.
D
Normal backup operation.
Why wrong: Backups usually go to internal or trusted cloud services, not known malicious IPs.

Read the full NAT/PAT explanation →

Question 8mediummultiple choice

A critical security patch for a widely exploited vulnerability is released. The patch requires a system reboot during business hours. According to change management policy, what is the best procedure?

Trap 1: Deploy the patch only at the end of the business day

While better than waiting, emergency approval is still needed to reboot during business hours.

Trap 2: Wait for the next scheduled change window

Delaying patching exposes the organization to exploitation.

Trap 3: Install the patch without approval

Installing without approval bypasses change control and could have unintended consequences.

A
Deploy the patch only at the end of the business day
Why wrong: While better than waiting, emergency approval is still needed to reboot during business hours.
B
Wait for the next scheduled change window
Why wrong: Delaying patching exposes the organization to exploitation.
C
Submit an emergency change request for immediate approval
Emergency change processes are designed for critical security updates.
D
Install the patch without approval
Why wrong: Installing without approval bypasses change control and could have unintended consequences.

Read the full NAT/PAT explanation →

Question 9easymultiple choice

You are monitoring network traffic and notice a sudden spike in outbound UDP traffic from a single internal host to various external IPs on port 123 (NTP). The traffic pattern shows a high volume of small packets. The host in question is a Linux server that does not run any NTP services. The IDS does not generate any alerts for this traffic. Which type of attack is most likely occurring?

Trap 1: The host is scanning for open NTP servers.

Scanning would show traffic to multiple ports, not just to port 123 on many IPs.

Trap 2: Data exfiltration via NTP tunneling.

NTP tunneling is possible but less common; the volume and pattern suggest amplification.

Trap 3: The host is performing an NTP time synchronization query.

The host does not run NTP services and the volume is too high for normal sync.

A
The host is participating in an NTP amplification DDoS attack.
NTP amplification uses small queries to generate large responses; the outbound traffic is the queries.
B
The host is scanning for open NTP servers.
Why wrong: Scanning would show traffic to multiple ports, not just to port 123 on many IPs.
C
Data exfiltration via NTP tunneling.
Why wrong: NTP tunneling is possible but less common; the volume and pattern suggest amplification.
D
The host is performing an NTP time synchronization query.
Why wrong: The host does not run NTP services and the volume is too high for normal sync.

Read the full VPN explanation →

Question 10mediummultiple choice

You are a security analyst at a healthcare organization. The organization uses Cisco Stealthwatch for network visibility and a SIEM for event correlation. You receive an alert that a medical records database server (IP 10.0.3.20) is communicating with an external IP (198.51.100.100) on port 22 (SSH) at 2:00 AM. The database server should have no outbound SSH connections; only remote administration is allowed from a management subnet via VPN. You check Stealthwatch and see that the connection duration is 30 minutes and the volume of data transferred is 500 MB. The database server logs show no local account logins at that time. The firewall logs show that the connection was initiated from the database server. The incident response team has been alerted. What is the most likely scenario and your immediate action?

Trap 1: Change the database administrator password immediately

Password change is insufficient if the attacker has a remote access tool installed.

Trap 2: Check if the SSH connection was an authorized remote administration…

The connection originated from the database server, not from an admin; it is likely malicious.

Trap 3: Investigate the database server logs for signs of compromise before…

Containment must come before investigation to stop ongoing data loss.

A
Change the database administrator password immediately
Why wrong: Password change is insufficient if the attacker has a remote access tool installed.
B
Check if the SSH connection was an authorized remote administration session
Why wrong: The connection originated from the database server, not from an admin; it is likely malicious.
C
Investigate the database server logs for signs of compromise before taking action
Why wrong: Containment must come before investigation to stop ongoing data loss.
D
Block the external IP 198.51.100.100 on the firewall and isolate the database server
Blocking the IP stops the exfiltration, and isolation prevents further compromise.

Read the full VPN explanation →

Question 11easymultiple choice

You are a security analyst at a mid-sized company. The company uses a SIEM to collect logs from firewalls, IDS, and servers. Recently, the SIEM generated an alert for a potential brute-force attack against the company's VPN server. The alert is based on a correlation rule that triggers when more than 30 failed authentication attempts from a single source IP occur within 10 minutes. You investigate and see that the source IP is 203.0.113.50, which is a known IP address of a partner company that uses the VPN for remote access. The failed attempts are all from the same username 'john.doe'. You also notice that the attempts are happening every 5 seconds, exactly 6 attempts per minute. The partner company has a policy that locks accounts after 3 failed attempts. Based on this scenario, what is the most likely cause of the alert?

Trap 1: The user 'john.doe' has forgotten his password and is repeatedly…

A human would not attempt exactly every 5 seconds for 10 minutes; the regularity suggests automation.

Trap 2: A man-in-the-middle attack is replaying captured authentication…

Replay attacks would likely succeed or cause different logs; the failed attempts indicate wrong credentials.

Trap 3: The partner's account 'john.doe' has been compromised and an…

An attacker would likely try multiple usernames or succeed after a few attempts; the lockout policy would prevent 30 attempts from the same source.

A
The user 'john.doe' has forgotten his password and is repeatedly trying to log in.
Why wrong: A human would not attempt exactly every 5 seconds for 10 minutes; the regularity suggests automation.
B
A script or automated process at the partner site is misconfigured and repeatedly trying to authenticate with an incorrect password.
The exact timing and same username point to a script; the lockout policy would lock the account after 3 attempts, but the script may be retrying from the same source, causing the SIEM alert before the lockout.
C
A man-in-the-middle attack is replaying captured authentication packets.
Why wrong: Replay attacks would likely succeed or cause different logs; the failed attempts indicate wrong credentials.
D
The partner's account 'john.doe' has been compromised and an attacker is attempting to gain access.
Why wrong: An attacker would likely try multiple usernames or succeed after a few attempts; the lockout policy would prevent 30 attempts from the same source.