Network Intrusion Analysis (20%)

200-201 · 60 questions

• At a logistics hub, a record lists byte and packet counts for one 5-tuple and includes no payload and no security verdict. Which source produces a record with that shape?
• At a retailer, a record says the application peer-file-share was denied even though an older rule had allowed that TCP port. Which technology produced the deny?
• At a university, a security record shows the user, the full URL, the category, and a block decision. Which technology produced that record?
• At a manufacturer, a record says a file hash was detected and the matching file was quarantined on a workstation. Which technology produced that record?
• At a bank, a monitoring record names a signature identifier, a severity, and a drop action taken on a flow. Which technology produced that record?
• At a hotel, a record says TCP from a guest device to port 443 was permitted, and the record names no application and no signature. Which technology produced that record?
• A detection rule at a bank alerts on a vulnerability scanner the bank scheduled, and that scanning is not an intrusion. How should the alert be classified?
• Ransomware spread across hospital systems and no sensor raised an alert during the spread. How should that detection miss be classified?
• At a retailer, a security alert fires and the analyst confirms that a real beacon is running on the checkout register. How should this investigated result be classified?
• At a SaaS company, one log shows a firewall allowed a 5-tuple, and another log from the same moment denies that flow after identifying a remote shell. Which log explains the deny?
• During a quiet night at a university, no security alert fires, and a later review of the same window finds no intrusion. How should that outcome be classified?
• An agency analyst is sorting a signature drop, a URL block that names a user and an address, and a byte count for a conversation. Which of those records came from the proxy?
• At a manufacturer, a signature matches an industrial vendor's licensed remote-support tool, and the change ticket authorized that tool for this window. The activity occurred and policy allows it. Which classification fits?
• At an agency, forensics shows an attacker forwarded an executive mailbox for a month, and no security alert fired during that period. Which detection label fits that outcome?
• A firewall at a retailer permits return traffic only when that traffic belongs to a connection an inside host already opened. Which inspection mode is the firewall using?
• A device at a bank allows or denies each packet using only addresses and ports, and it does not remember the handshake of any connection. Which kind of device is that?
• A hotel SOC compares four outcomes from the same week: an attack with no alert, an alert that wasted an hour, a quiet night with no intrusion, and an approved support tool. Which outcome is the one in which the attacker had impact?
• An MSSP customer wants every alert called a true positive. On a customer host, an authorized backup trips a rule that labels the transfer as data theft. What is the right label for that alert?
• At a manufacturer, a security device sits in the forwarding path and drops an industrial-protocol exploit before the packet reaches a controller. Which deployment is that device using?
• At a hospital, a sensor receives only a copy of clinical traffic, and powering that sensor off does not stop the clinical traffic. Which deployment matches this result?
• At a hotel, a sensor outage left the guest network up while detection of that guest traffic stopped. Which design fits both of those results?
• A control at a university reads the HTTP body looking for a script tag and does not stop its decision at the destination port. Which inspection mode is that control using?
• Three products sit on one link at a logistics hub, and an analyst must choose the product that can name an application command carried inside the payload. Which product does that?
• At a bank, the team must block command-and-control packets on the path, and merely recording a copy of those packets will not perform the block. Which statement is accurate?
• At a manufacturer, a packet capture contains one unencrypted file download carried on a single TCP session. How should the analyst recover that file from the capture?
• At a university, an investigation only needs to know who talked to a rare address and how many bytes moved. Compared with a full packet capture, which lighter source answers that question?
• An agency analyst needs the unencrypted file a host downloaded. A week of NetFlow is stored, and no packets were saved. What gap prevents recovery of that file?
• At a bank, leadership wants to know which conversations moved the most data last month, and no packets from that month were retained. Which source can still answer the volume question?
• At a retailer, a tap captured a file transfer, and NetFlow shows the same 5-tuple with byte counts for that transfer. Which source can yield the file itself?
• At a SaaS company, a file moved inside TLS. The packet capture contains those packets, and the team does not have the server private key. What will TCP stream reassembly produce?
• At a hotel, the IP header protocol field on a captured packet says TCP, but a later analyst labels that same packet UDP after noticing the application is a VPN. What corrects the label?
• A university capture of a clear HTTP request contains a script tag in the request URI, while the host addresses look like ordinary campus machines. Which element carries the attack text?
• A hospital analyst holds a packet capture of a cleartext HTTP file download from a clinical workstation. What is the practical way to extract that file from the capture?
• At a logistics hub, two different files traveled inside two TCP sessions between the same pair of IP addresses. What must be separated before either file can be carved from the capture?
• A bank packet capture shows 10.1.1.20 sending a TCP SYN to 203.0.113.50 on port 443, and no reply has arrived yet. What is the source address of this session?
• A retailer capture of a client session shows destination port 443 and a high ephemeral source port on the same packets. Which value identifies the service the client contacted?
• At a hospital, an analyst must name what carried the exploit bytes. The IP header protocol number is 6, and the payload begins with an HTTP request line. What carried those bytes?
• At an MSSP, a capture shows a TCP SYN from port 51514 to port 22, and a junior analyst treats port 51514 as the service and the destination host as the client. What is the correction?
• At a manufacturer, a captured payload is encrypted, while the IP header still shows the address where the packet was sent. Which element remains usable for scoping the flow?
• At an agency, a capture line lists source 198.51.100.10, destination 198.51.100.20, destination port 445, and protocol TCP. Which element shows the service the sender contacted?
• At a bank, a captured frame carries a source MAC that is not the MAC the switch learned for that IP yesterday. Which header in the frame contains the MAC address?
• At a retailer, an IPv4 packet that should cross the store WAN reaches the first router with a TTL of 1 and dies there. What does that TTL value explain?
• At a hotel, a capture shows ICMP type 8 sent to the gateway and ICMP type 0 returned to the sender. Which exchange do those two ICMP types form?
• At a university, a captured IPv6 header has a next-header field that indicates TCP. What does that field tell you about the packet?
• At a manufacturer, a TCP header has SYN set and ACK unset, and the capture has no earlier packet for that 5-tuple. What do those flags mean?
• At a logistics hub, a UDP header shows destination port 53 and a short length, and the capture has no handshake for that flow. Why is the missing handshake normal?
• At an agency, a DNS query requests a TXT record whose name is a long random label, and the answer returned for that name is long as well. What suspicious use do that query and that answer support?
• At a bank, an SMTP transcript shows one address in MAIL FROM and a different address in the message From header. Which value did the receiving server use as the envelope sender?
• A bank intrusion alert includes a source address and a destination address, and the destination is the bank payroll server. Which address is the asset to scope first?
• At a retailer, an ARP reply tells the switch that the gateway IP address belongs to a cash-register MAC, and no ARP request was seen. Which artifact is that reply?
• In a hospital lab, HTTP/2 rides TCP port 443 in the clear, and a request pseudo-header carries the path. What changed relative to an HTTP/1 request line?
• At a SaaS company, a cleartext HTTP request line is GET and the Host header names a look-alike domain. Which field carries the site name the client asked for?
• At a logistics hub, one host fetches a mailbox with IMAP and later sends mail with SMTP to the same server. Which header family separates those two services?
• A university alert lists client port 49822 and server port 445 on the same connection. Which value identifies the service?
• A logistics hub alert shows a URI containing a scripted database predicate. The addresses on the alert are the warehouse web server and a clerk PC. Which artifact carries the injection?
• A manufacturer alert names a process path and a registry run-key value on a single host. What do those two artifacts describe?
• At an agency workstation, a detection record shows a script host making an unusual API call that allocates memory inside a second process. What kind of artifact is that record describing?
• At a bank, an analyst tests patterns against the address string 10.8.0.15 and must reject any pattern that also matches 192.168.0.15. Which pattern matches 10.8.0.15 and does not match 192.168.0.15?
• At a retailer, analysts are filtering file names, and the name under review is invoice.exe.txt. Which pattern matches a name that ends in .exe and does not match invoice.exe.txt?
• A hotel SOC sees two alerts that share one file hash and list two different guest-network IP addresses. What does that shared hash tie together?