Domain 2: Network Security Monitoring (Zeek, Suricata, PCAP, IDS/IPS)

GIAC Certified Enterprise Defender · 37 questions

• A Zeek analyst notices that a connection log shows a large number of sessions to a single external IP with very short durations and fixed byte counts. This pattern is most consistent with which type of activity?
• A Suricata rule fires on outbound HTTP traffic containing the string 'cmd.exe' in the URI. The rule uses the http.uri keyword. Which Suricata inspection engine processes this rule?
• An analyst uses Wireshark to capture traffic and applies the filter tcp.flags.syn==1 && tcp.flags.ack==0. What does this filter capture?
• An NSM analyst observes Zeek logs showing a connection where the origbytes is 500 and respbytes is 2,500,000. The destination port is 443. What does this asymmetry suggest?
• A security engineer wants to deploy IDS sensors to detect lateral movement within the enterprise. Where should sensors be placed for maximum effectiveness?
• Which Zeek log file would an analyst examine to identify DNS queries for newly registered or unusual domains associated with C2 infrastructure?
• During PCAP analysis, an analyst notices TCP sessions where the three-way handshake completes but no data is ever transferred before the connection is reset. Large numbers of these are observed across many destination ports. What does this indicate?
• A Suricata alert fires with the message 'ET POLICY Outbound DNS Query for TOR Exit Node.' The alert appears on a workstation used by a financial analyst. What should the analyst do first?
• An IDS signature matches on a specific exploit payload, but the analyst confirms the target system runs a patched OS where the vulnerability does not exist. This alert is classified as:
• A SOC analyst is writing a Suricata rule to detect HTTP POST requests to a specific URI path containing suspicious data. Which rule option correctly targets the normalized HTTP POST body?
• An analyst reviews Zeek ssl.log and notices multiple connections where the subject field of the server certificate is 'CN=localhost' and the issuer matches the subject (self-signed). The connections are outbound to external IPs on port 443. Why is this suspicious?
• An NSM analyst wants to identify hosts that may be participating in a DGA (Domain Generation Algorithm) botnet. Which combination of Zeek log fields most effectively identifies DGA activity?
• A security analyst uses Wireshark and applies the display filter http.request.method == "POST" && http contains "password". What is the security risk this filter is attempting to identify?
• An IDS in a production environment generates an alert for an inbound connection matching an exploit signature for a service that is not running on the target host. After verification, this is classified as a false positive. What tuning action reduces similar false positives for this specific rule?
• Which Zeek log is most useful for identifying file transfers and malware downloads, including file hashes of transferred content?
• A Suricata detection rule uses the keyword flow:established,toserver. What does this specify?
• An analyst examines Zeek's x509.log and finds a certificate with an unusually short validity period of 24 hours issued by 'Let's Encrypt.' The certificate is for a domain registered 2 days ago. Why is this combination suspicious?
• A network security analyst reviews Zeek http.log and notices that a web server is receiving requests where the referrer field is blank but the URI contains deeply nested paths such as '/admin/config/backup/export'. This pattern repeats from multiple external source IPs. What does this suggest?
• An analyst wants to use Zeek to detect SSH brute-force attacks. Which built-in Zeek script and log provide this capability?
• A Zeek analyst notices entries in notice.log with the note type Scan::PortScan pointing to an internal IP address as the scanner. What does this indicate and what is the appropriate investigative action?
• An analyst wants to identify all external DNS resolvers being queried by internal hosts, to detect DNS bypassing the corporate resolver. Which Zeek log and query should be used?
• A Suricata IPS is deployed in inline mode. When a signature matches, what action keyword causes Suricata to drop the matching packet and generate an alert?
• During packet analysis of a suspected C2 channel, an analyst sees HTTP GET requests to 'http://198.51.100.10/update.php?id=AaBbCcDdEeFf1234' repeating every 60 seconds with consistent 256-byte responses. The 'id' parameter changes each iteration. What does this pattern suggest?
• A PCAP analyst examines a file and sees many TCP packets with the PSH and ACK flags set in a consistent pattern with uniform inter-arrival times. Combined with small, fixed-size payloads, what technique might this indicate?
• Which Zeek log file records detected attacks and policy violations generated by Zeek's scripting framework and built-in detectors, separate from specific protocol logs?
• A Suricata rule developer wants to write a rule that detects outbound HTTPS connections where the TLS SNI (Server Name Indication) contains a known malicious domain. Which Suricata keyword targets the TLS SNI field?
• An analyst is analyzing a PCAP file and identifies a TCP stream where large volumes of data are sent from an internal host to an external destination over port 443, but the traffic patterns do not match standard TLS handshake sequences. What should the analyst investigate?
• During network security monitoring, an analyst observes Zeek logs showing an internal host (192.168.1.50) making ICMP requests to 254 different hosts within the 192.168.1.0/24 subnet within 30 seconds. What does this indicate?
• A security team is implementing network security monitoring and must decide where to place IDS/IPS sensors relative to NAT boundaries. What monitoring blind spot does NAT create for an IDS sensor placed outside the NAT boundary?
• An analyst uses Zeek's http.log and notices a request where uri is '/wp-admin/admin-ajax.php' and useragent is 'sqlmap/1.0'. What is the most appropriate immediate action?
• A Suricata analyst wants to write a rule that detects outbound HTTP connections where the Host header contains an IP address instead of a domain name. Why is this significant from a security perspective?
• An NSM analyst is reviewing Zeek logs and sees conn.log entries with connstate of 'S0'. What does this connection state indicate?
• A SOC analyst is reviewing logs and notices that a DNS query for 'abcdefghijklmnopqrstuvwxyz1234567890.malicious-domain.com' returned an A record. Combined with high query frequency, what attack is most likely occurring?
• A network analyst runs Zeek and notices that the tunnel.log shows an IP-in-IP tunnel originating from an internal workstation. Why is this significant from a security perspective?
• A network security monitoring analyst wants to understand what percentage of network sessions are encrypted on the enterprise network. Which Zeek log provides the most direct answer?
• During a network security investigation, an analyst uses the Wireshark filter smtp contains "RCPT TO" to examine email traffic. The analyst finds emails being sent to an external domain with 15 distinct recipients. What should the analyst investigate further?
• An IDS analyst identifies that a Suricata signature is using the fastpattern keyword. What does this keyword do and why is it important?