Network Incidents

During network forensics, you need to reconstruct an HTTP file transfer from a PCAP. Which Wireshark feature allows you to extract the file object directly from the stream?

When segmenting a network to contain an incident, what is the best practice for a 'Jump Server' in a DMZ to limit the attack surface?

You are using NetFlow to identify lateral movement. You see a high volume of connections from a web server to an internal database server on port 3306. What is the most appropriate next step in the investigation?

An incident responder is using NetFlow to identify a data exfiltration event. What specific field in a NetFlow v9 record provides the best indication of the total volume of data moved between two internal hosts?

Which THREE of the following characterize potential lateral movement using RDP in a domain environment?

You are analyzing a PCAP file to detect 'Pass-the-Hash' activity. Which SMB message type should you specifically look for in the NTLM authentication exchange?

What is the purpose of 'Network Segmentation' during an active network incident?

You are using an IDS/IPS to detect lateral movement. You notice that your NIDS is not alerting on SSH brute force attempts. Which configuration check is most important to perform?

When reviewing firewall logs, you see many 'deny' events from an internal host to an external IP. What is the most likely cause?

You are identifying a compromised host by checking for beaconing behavior. Which network metric is most indicative of heartbeat-style beaconing?

An attacker is using ICMP tunneling to exfiltrate data. What field in an ICMP echo request packet would contain the unauthorized data?

Which technique should an incident responder use to prevent an infected host from spreading ransomware via SMB to other segments in the network?

Which TWO of the following techniques would an attacker likely use to hide lateral movement traffic within a network?

Which TWO of the following are common signs of a compromised switch in a local area network?

Which THREE of the following are key components of a network-based containment strategy?

A security analyst is investigating lateral movement using PowerShell Remoting (WinRM). Which Windows Event Log should be prioritized to confirm the execution of remote commands?

During an investigation into lateral movement, you notice an unusual RDP connection from a workstation to a domain controller. Which Wireshark filter would be most effective in isolating only the RDP traffic associated with that specific source IP to identify potential credential dumping activity?

Which TWO of the following are common network-based indicators of a compromised host attempting to perform network discovery?

You suspect a DNS tunneling attack for data exfiltration. In your DNS server logs, which characteristic is the strongest indicator of a tunnel rather than standard recursive lookups?

You are performing log correlation in a SIEM. You want to match Windows Event ID 4624 (Logon) with network traffic. Which field is the primary 'join key' to correlate the event with a specific network flow?

You are investigating a compromised Linux host. Using 'tcpdump' to capture traffic on interface eth0 to analyze C2 communication on port 443, which command is most efficient for saving the output to a file for later analysis in Wireshark?

Which THREE of the following represent critical log sources that should be correlated when investigating a potential network-based exfiltration incident?

Which TWO of the following indicators are primary artifacts to look for when investigating potential lateral movement on a Windows network?

Which syslog facility would typically be configured on a network device to send audit logs to a central server?

Which TWO of the following steps are considered best practices when performing network forensics on a live environment?

Which THREE of the following are effective network forensics techniques for identifying an attacker's C2 server infrastructure?