4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is examining a packet capture and sees an ICMPv4 packet with type=8, code=0, checksum=0x4d5a, and a payload that contains the ASCII string 'ping'. The IP header shows TTL=128, protocol=1, source=10.0.0.1, destination=10.0.0.2. What does this packet represent?

   • AAn ICMP echo reply, which indicates the destination is reachable.
   • BAn ICMP time exceeded message, indicating the TTL reached zero.
   • CAn ICMP echo request, which is used to test reachability between the two hosts.
   • DAn ICMP destination unreachable message, indicating a routing problem.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is investigating a network anomaly. The capture shows a series of ARP requests from a single host (MAC 00:11:22:33:44:55) asking 'Who has 192.168.1.1?' and 'Who has 192.168.1.2?' and so on, for every IP in the subnet, all within a few seconds. The analyst also sees an ARP reply from the same host claiming to be 192.168.1.1. What is the most likely explanation for this behavior?

   • AThe host is experiencing a network loop, causing it to send ARP requests repeatedly.
   • BThe host is performing a legitimate ARP cache refresh after a network change.
   • CThe host is using a misconfigured DHCP client that is trying to find a valid IP address.
   • DThe host is scanning the network to map active IP addresses, which is a precursor to an ARP spoofing attack.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a suspected ARP spoofing attack on a local subnet. The capture shows an ARP packet with: hardware type=1, protocol type=0x0800, hardware size=6, protocol size=4, opcode=2 (reply), sender MAC=00:11:22:33:44:55, sender IP=192.168.1.1, target MAC=ff:ff:ff:ff:ff:ff, target IP=192.168.1.100. The analyst knows the legitimate gateway is at 192.168.1.1 with MAC 00:aa:bb:cc:dd:ee. What is the most significant anomaly in this ARP packet?

   • AThe target IP is 192.168.1.100, which is a client address, but the target MAC is broadcast, so the reply is being sent to everyone.
   • BThe opcode is 2 (reply) but the target MAC is a broadcast address, which is unusual for a unicast reply.
   • CThe protocol type is 0x0800, which indicates IPv4, but the packet is an ARP reply, so the protocol type should be 0x0806.
   • DThe sender IP is 192.168.1.1, which is the gateway, but the sender MAC does not match the legitimate gateway MAC.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An email security analyst is examining a capture of SMTP traffic. The analyst sees the following commands: EHLO mail.example.com, MAIL FROM:<attacker@example.com>, RCPT TO:<victim@company.com>, DATA, and then the message body. The analyst notices that the 'Received:' header in the message body shows a different source IP than the SMTP connection's source IP. What does this discrepancy indicate?

   • AThe SMTP connection is using a different protocol than the 'Received:' header, so the IPs will always differ.
   • BThe SMTP connection is using a proxy, so the source IP is the proxy's address, not the original sender's.
   • CThe email was sent from a different server than the one that initiated the SMTP connection, indicating possible email spoofing.
   • DThe email is legitimate because the 'Received:' header is always added by the final destination server.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing a TCP capture and sees a segment with the following header fields: source port=12345, destination port=80, sequence number=1000, acknowledgment number=0, data offset=5, flags=SYN, window size=65535, checksum=0xabcd, urgent pointer=0. The IP header shows protocol=6, source=192.168.1.10, destination=93.184.216.34. What is the most accurate interpretation of this segment?

   • AThis is a TCP FIN segment indicating the client is closing the connection.
   • BThis is the first step of a TCP three-way handshake, initiating a connection to a web server.
   • CThis is a TCP RST segment indicating an error or connection refusal.
   • DThis is a TCP ACK segment acknowledging data received from the server.
   Reveal Solution Discussion Select an answer first