CCNA Network Incidents Questions

The response body is encrypted binary data, which likely contains the actual C2 commands. To understand the protocol structure and extract commands, you must decrypt the payload using the malware's decryption algorithm. This requires reverse engineering the malware or knowing the key. Once decrypted, the structure and commands become visible, providing direct insight into the C2 communication.

The workstation is sending forged ARP replies to associate the DMZ server's IP with its own MAC address, causing traffic destined for the server to be redirected to the attacker. The mismatch between the Ethernet source MAC and the IP source in captured packets confirms this Layer 2 redirection, which is the defining behavior of ARP cache poisoning in a switched network.

Export Objects reconstructs transferred files by reassembling the HTTP response body from the TCP stream, giving the analyst the original object. This directly satisfies the requirement to extract a file from a PCAP without manually following and decoding each stream.

Gratuitous ARP replies are sent without a request to update ARP caches. In ARP poisoning, the attacker sends gratuitous ARP replies to overwrite legitimate entries, claiming that their MAC address corresponds to an IP like the gateway. This is a direct indicator of ARP spoofing and is often observed in packet captures.

Whitelisting permitted source IP addresses on the jump server ensures only authorised administrative hosts can initiate connections, sharply reducing exposed services in the DMZ. This directly limits the attack surface, satisfying the stem's segmentation best-practise requirement for containing an incident.

Port 4444 is commonly associated with Metasploit and other penetration testing tools, and encrypted traffic to an external IP on this port is a strong indicator of command and control communication. The slow performance could be due to the malware's activities, such as data exfiltration or resource consumption. This combination of factors points to a compromised host communicating with an attacker-controlled server.

Examining the web server's process list identifies which executable initiated the MySQL connections, distinguishing legitimate application traffic from attacker tooling. NetFlow alone confirms volume and endpoints but not the originating process, so this step satisfies the need to attribute the port 3306 traffic before escalating or containing.

Capturing network traffic and ARP tables preserves volatile evidence such as the attacker's MAC address, IP, and the frequency of spoofed ARP replies. Isolating the affected VLAN (e.g., by moving it to a quarantine VLAN or applying an ACL) contains the threat by preventing the attacker from reaching other segments, while still allowing forensic investigation. This approach balances immediate mitigation with evidence preservation, which is critical for incident response.

The pattern of many SYN packets to a single destination without SYN-ACK responses is classic for a SYN flood. The attacker sends numerous SYN requests, exhausting the server's connection table, causing it to become unresponsive. The lack of SYN-ACKs indicates the server is overwhelmed or the source IPs are spoofed. This is a denial-of-service attack aimed at making the service unavailable.

Short, periodic connections to an external IP on TCP port 443 with small, consistent data transfers are characteristic of beaconing behavior. Malware often uses HTTPS to blend in with normal traffic, and the regular intervals and small payloads are designed to check for commands without attracting attention. This pattern strongly suggests command-and-control communication.

RDP normally negotiates Kerberos in a domain, so NTLM authentication indicates fallback credentials, misconfiguration or an attacker lacking a valid ticket. This deviation from expected Kerberos behaviour is the anomaly that signals possible lateral movement.

This approach directly targets the suspected exfiltration channel. By reassembling the TXT record responses and decoding the base64 content, the analyst can extract the actual data being sent out. It leverages the fact that DNS TXT records can carry arbitrary data, and the base64 encoding suggests deliberate obfuscation. This method is precise and provides evidence of the exfiltrated content.

Segmentation splits the network into isolated zones through VLANs, ACLs or firewall policies, restricting lateral movement so the attacker cannot reach other systems. This directly delivers containment during an active incident by cutting communication paths, rather than merely detecting or documenting the intrusion.

Regular, small DNS queries to a single external domain can indicate DNS tunneling for data exfiltration. Attackers encode data in DNS queries and responses, often at regular intervals to avoid detection. The small size and regularity are designed to blend with normal DNS traffic. Incident handlers should analyze the DNS query patterns and payload sizes for anomalies.

A TCP SYN flood sends numerous SYN packets with spoofed source addresses to a target, causing the server to allocate resources for half-open connections. The server's connection table fills up, preventing legitimate connections. The observed high volume of SYNs without SYN-ACK replies and the full connection table are classic indicators of a SYN flood.

Repeated deny events from one internal host toward a single external IP indicate beaconing behaviour typical of malware contacting its command-and-control server. The firewall blocks each attempt, satisfying the stem's scenario of many denies to an external address.

Consistent interval between connections exposes the periodic timing that heartbeat-style beaconing depends on: malware must check in at regular intervals to receive commands. This regularity distinguishes it from bursty legitimate traffic, satisfying the stem's requirement for the metric most indicative of beaconing behaviour.

ICMP echo requests carry arbitrary payload in the data field, which tunnelling tools abuse to smuggle exfiltrated content inside packets that firewalls often permit. The type, code and checksum fields hold fixed protocol values and cannot carry the unauthorised data.

A large number of deny events from an internal host to various external IPs on different ports is indicative of port scanning activity. Malware often performs port scanning to discover vulnerable services on remote hosts. Since the workstation should only access a limited set of services, this behavior is anomalous and suggests compromise. The deny events are the firewall blocking the unauthorized scanning attempts.

SMB ransomware propagation uses TCP 445, so ACLs blocking that port between segments halt lateral spread while leaving other traffic intact. This directly satisfies the containment constraint by severing the specific channel the infected host exploits.

Trunk ports carry traffic for multiple VLANs, so an unrecognised trunk enabled on an access switch lets an attacker reach other VLANs, bypassing segmentation. This unauthorised configuration change is a strong indicator that the switch has been compromised.

Isolation severs the compromised segment's Layer 2 and Layer 3 connectivity, preventing lateral movement to healthy subnets while the incident is investigated. This directly satisfies the containment requirement by limiting blast radius, and is a recognised key component alongside traffic filtering and endpoint quarantine in network-based containment strategies.

ICMP tunneling involves encapsulating data within ICMP echo requests and replies, often using oversized payloads to carry stolen data. A sudden spike in ICMP traffic with consistently large payloads to an external IP is a strong indicator of this technique. Attackers use ICMP tunneling to bypass firewalls that allow ping, making it a stealthy exfiltration method.

PowerShell Remoting executes commands through the PowerShell engine, which writes script block and command invocation events to the Microsoft-Windows-PowerShell/Operational log. Event ID 4104 records the actual script content executed remotely, confirming command execution that WinRM transport logs alone cannot show.

Event ID 5140 is generated when a network share is accessed. It records the share name, the account used, and the source IP address. In the context of suspected SMB lateral movement, a burst of 5140 events for administrative shares like ADMIN$ or C$ from a single workstation to multiple servers is a direct indicator of an attacker enumerating and accessing remote shares. This event provides concrete evidence of the lateral movement attempt.

DNS tunneling involves encoding data within DNS queries and responses, often using TCP port 53 for larger transfers. A large outbound data transfer to an external IP over TCP port 53 is a strong indicator of DNS tunneling, as legitimate DNS traffic is typically small and uses UDP. Attackers use this method to bypass firewalls that allow DNS traffic.

Combining tcp.port == 3389 with ip.src == 192.168.1.50 restricts capture to RDP sessions originating from the suspect workstation, filtering out unrelated port 3389 traffic. This isolates the lateral-movement flow toward the domain controller for credential-dumping analysis.

A high volume of TCP SYN packets across many ports indicates port scanning, the primary network-discovery technique. The half-open SYN sweep maps listening services without completing handshakes, directly satisfying the stem's requirement for a network-based indicator of discovery activity.

The repeated SYN packets to a single port on multiple external IPs, with no completed handshake, is classic TCP SYN scanning behavior. An incident handler identifies this as reconnaissance or an attempt to find an open service. The lack of response is expected because the scanner is probing many hosts, and the consistent destination port suggests a targeted service discovery.

An HTTP flood is a type of denial-of-service attack where the attacker sends many HTTP requests to overwhelm the server. The requests often target resource-intensive functions like search, with complex query strings to maximize CPU usage. The observed CPU spike and high volume of requests to a search function are classic signs of an HTTP flood.

DNS tunnelling encodes exfiltrated data into query names, producing subdomains far longer than legitimate hostnames and with high entropy from base64 or hex encoding. This pattern distinguishes tunnelling from normal recursive lookups, which resolve short, dictionary-like names.

Event ID 4624 records the originating workstation's IP address in its network information fields. That address is the shared identifier matching the corresponding network flow records in the SIEM, letting the analyst join authentication events to specific traffic.

The -w flag correctly writes the captured traffic to a file.

DNS query logs reveal domain lookups made by internal hosts, exposing contact with command-and-control or exfiltration domains. Correlating them with flow and proxy logs identifies which host resolved a suspicious destination, a critical pivot during network exfiltration investigations.

Blocking the external IP at the perimeter firewall severs the connection to the suspected malicious endpoint, preventing further data exfiltration or command-and-control. This is a targeted containment measure that can be implemented quickly without disrupting the internal network. It also allows the responder to continue monitoring the internal server for other outbound connections.

Network devices commonly use the local0 through local7 facilities for custom log destinations, since these are reserved for local use and avoid clashing with system facilities like auth or daemon. Configuring local0 lets the device forward audit logs to the central syslog server without conflicting with standard facility assignments.

A documented chain of custody records who handled each PCAP, when, and how, preserving evidential integrity so findings remain admissible. This satisfies the live-forensics requirement that collected packet captures be verifiable and untampered throughout investigation and any subsequent legal proceedings.

Reverse DNS maps a destination IP back to a registered hostname via PTR records, often exposing provider-assigned names or compromised domains tied to C2 infrastructure. This satisfies the stem's identification goal by correlating observed traffic destinations with naming that direct forward lookups would miss.