Network Incidents

During a network incident, you observe that an internal host is communicating with an external IP address on TCP port 8080. The traffic is HTTP and contains periodic GET requests to '/update.php' with a custom User-Agent string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' but the response body is encrypted binary data. You suspect this is command-and-control (C2) communication. Which network forensic artifact would most directly reveal the C2 protocol structure and commands being sent?

During a network incident, your IDS alerts on a series of TCP packets with the SYN flag set and a source IP of 10.20.5.14, but packet captures on the internal switch show that the actual Ethernet source MAC address belongs to a workstation in the finance VLAN, while the IP 10.20.5.14 is assigned to a server in the DMZ. The workstation's ARP cache lists the DMZ server's IP as being at the workstation's own MAC address. Which network-based attack technique is the workstation most likely performing?

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

A network incident responder is analyzing a suspected ARP poisoning attack on a local subnet. Which two indicators would most likely be observed in the network traffic or ARP cache? (Choose two.)

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

An incident responder notices that a workstation is communicating with an external IP address on port 4444, and the traffic is encrypted. The workstation's user reports that the computer is running slowly. Which type of network incident is most likely indicated?

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

During a network incident, you observe a large volume of ARP replies from a single MAC address claiming to be the default gateway. Which containment action should you take first to mitigate the immediate threat while preserving evidence for forensic analysis?

A network incident responder is analyzing a packet capture and notices a large number of TCP SYN packets sent from various source IP addresses to a single destination IP address on port 80, but no corresponding SYN-ACK packets. The destination server is unresponsive. Which type of network incident is most likely occurring?

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

A security analyst is reviewing a packet capture from a suspected compromised workstation. The analyst notices a series of DNS queries for random-looking subdomains such as 'a1b2c3d4.evil.com', 'e5f6g7h8.evil.com', and 'i9j0k1l2.evil.com'. Each query is followed by a TXT record response containing long base64-encoded strings. The analyst suspects data exfiltration. Which network forensic technique would best confirm and extract the exfiltrated data from this traffic?

What is the purpose of 'Network Segmentation' during an active network incident?

A network incident has been declared due to a suspected data exfiltration. You are reviewing network flow data to identify the exfiltration channel. Which TWO of the following characteristics are most indicative of data exfiltration over a covert channel? (Choose two.)

A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

A security analyst is reviewing firewall logs and notices a large number of 'deny' events from an internal host to various external IP addresses on different ports. The internal host is a user workstation that should only access a limited set of external services. Which of the following is the MOST likely cause of these deny events?

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Which TWO of the following are common signs of a compromised switch in a local area network?

Which THREE of the following are key components of a network-based containment strategy?

A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

A financial institution's SOC detects anomalous SMB traffic from a workstation to multiple servers, including attempts to access ADMIN$ shares. Which TWO of the following artifacts should an incident responder prioritize to confirm lateral movement via SMB? (Choose two.)

A security analyst is investigating a suspected data exfiltration incident. The analyst reviews NetFlow records and notices a large outbound data transfer from an internal server to an external IP address over TCP port 53. Which of the following is the MOST likely explanation for this activity?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

During a network incident, you capture traffic and notice a workstation repeatedly sending TCP SYN packets to a single external IP on port 443, but the external host never responds. The workstation then sends the same SYN to a different external IP on port 443. Which network artifact best characterizes this behavior?

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?