4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   In a PCAP, an analyst sees a packet with source IP 192.168.1.100, destination IP 8.8.8.8, source port 50000, and destination port 53. The payload contains a DNS query for 'malware.example.com'. What is the destination IP address of this packet?

   • A192.168.1.100
   • B8.8.8.8
   • C53
   • Dmalware.example.com
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing a PCAP from an internal host that contacted an external server. The packet shows an IP header with protocol 17, a UDP header with source port 5353 and destination port 5353, and a payload containing the string '_http._tcp.local'. Which service discovery mechanism is being used?

   • ADNS over TCP
   • BNetBIOS Name Service
   • CmDNS (Multicast DNS)
   • DSSDP (Simple Service Discovery Protocol)
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A PCAP file contains a packet that starts with a 14-byte Ethernet header, followed by a 20-byte IPv4 header, followed by a TCP header. The analyst needs to find the source port. Where should they look?

   • AIn the TCP header after the IPv4 header
   • BIn the IPv4 header
   • CIn the payload of the TCP segment
   • DIn the Ethernet header
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A PCAP shows a TCP connection from 10.0.0.5 to 192.0.2.20. The first packet has source port 49152 and destination port 22. The analyst needs to determine which port the client will use for subsequent packets in the same connection. What should the analyst expect?

   • AA new random source port for each packet
   • BThe destination port 22 as the source port
   • CThe source port will increment by one each packet
   • DThe same source port 49152
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is reviewing a PCAP from a compromised host. The PCAP shows a TCP stream from 10.0.0.5 to 203.0.113.7 on destination port 4444. The payload contains a series of commands including 'whoami', 'ls', and 'cat /etc/passwd'. The stream then shows a file transfer containing the string 'MZ' at the start. What is the most likely conclusion?

   • AThe host is running a legitimate FTP server
   • BThe host is sending an email with an attachment
   • CThe host is under the control of a remote attacker via a reverse shell
   • DThe host is performing a DNS query
   Reveal Solution Discussion Select an answer first