4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An analyst is investigating a potential DNS tunneling attack. The analyst sees a DNS query for 'abcdefghijklmnopqrstuvwxyz.example.com' with a query type of TXT. The response contains a TXT record with a long string of base64-encoded data. The source IP is 192.168.1.10 and the destination IP is 8.8.8.8. Which field in the DNS message would the analyst examine to determine if the response is from a legitimate DNS server?

   • AThe QR flag
   • BThe AA (Authoritative Answer) flag
   • CThe RA (Recursion Available) flag
   • DThe TC flag
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst is investigating a suspected ARP spoofing attack. The analyst sees an ARP reply packet with the sender hardware address 00:11:22:33:44:55 and the sender protocol address 192.168.1.1. The target hardware address is 00:aa:bb:cc:dd:ee and the target protocol address is 192.168.1.10. The Ethernet frame has a source MAC of 00:11:22:33:44:55 and a destination MAC of 00:aa:bb:cc:dd:ee. Which observation would most strongly indicate that this is an unsolicited ARP reply?

   • AThe target protocol address is different from the sender protocol address
   • BThe sender hardware address is different from the target hardware address
   • CThe ARP reply was sent without a corresponding ARP request
   • DThe Ethernet destination MAC is not a broadcast address
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is examining a packet capture that shows a TCP connection to a web server. The client sends a SYN packet with a TTL of 64 and an IP identification of 0x1234. The server responds with a SYN-ACK. The client then sends an ACK, followed by an HTTP GET request. The analyst notices that the IP identification field in the client's subsequent packets is incrementing by 1. What is the most likely explanation for this pattern?

   • AThe client is using a custom TCP stack that randomizes the IP identification field
   • BThe client is behind a NAT device that is rewriting the IP identification field
   • CThe client is sending fragmented packets
   • DThe client is generating packets from a single process
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which flag in the DNS header indicates that the message is a response to a query?

   • AAA (Authoritative Answer)
   • BRD (Recursion Desired)
   • CTC (Truncated)
   • DQR (Query/Response)
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   An analyst is examining an ICMP packet that has a type field of 8 and a code field of 0. The IP header shows a TTL of 64 and a protocol field of 1. The ICMP payload contains a timestamp. What is the most likely purpose of this packet?

   • ATo indicate that the TTL has expired
   • BTo test reachability of a host
   • CTo report that a destination is unreachable
   • DTo synchronize clocks between hosts
   Reveal Solution Discussion Select an answer first