4.8 Interpret the Fields in Protocol Headers as Related to Intrusion Analysis 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · medium

   While analyzing a captured IPv6 packet, a security analyst observes the following header fields: Version = 6, Traffic Class = 0x00, Flow Label = 0x00000, Payload Length = 40, Next Header = 6, Hop Limit = 64, Source Address = 2001:db8::1, Destination Address = 2001:db8::2. Which statement correctly interprets these fields?

   • AThe Next Header value of 6 indicates that the payload is a TCP segment, and the Hop Limit of 64 means the packet can traverse up to 64 router hops before being discarded.
   • BThe Payload Length of 40 includes the IPv6 header itself, so the total packet length is 40 bytes, and the Next Header value of 6 indicates that an extension header follows.
   • CThe Flow Label of 0x00000 indicates that this packet is part of a specific real-time flow, and the Traffic Class value of 0x00 means the packet has been marked for expedited forwarding.
   • DThe Hop Limit of 64 is the maximum number of hops the packet has already traversed, and the Source Address 2001:db8::1 is a globally routable unicast address.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An analyst notices an ARP reply that claims the sender's IP address is 192.168.1.1, but the sender's MAC address is different from the legitimate gateway's MAC. What type of attack is likely occurring?

   • AIP address spoofing
   • BARP spoofing
   • CDNS poisoning
   • DMAC flooding
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which protocol is used by an email client to retrieve messages from a server while typically leaving a copy of the messages on the server?

   • AHTTP
   • BIMAP
   • CSMTP
   • DPOP3
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst is examining a DNS capture from an internal client. The DNS header shows: QR=0, Opcode=0, RD=1, and the Question section contains a single query for 'update.example.com' with QTYPE=A. The response (QR=1) has RCODE=0 and the Answer section contains an A record pointing to 10.10.10.5. The analyst also sees a TCP SYN from the client to 10.10.10.5 on port 53 immediately after. What does this sequence indicate?

   • AThe client is performing a zone transfer because the response contains multiple records.
   • BThe client resolved the hostname and is now initiating a standard DNS query over TCP for additional security.
   • CThe client received a valid answer and is now making a second DNS query over TCP, possibly for a different record type or due to truncation.
   • DThe client is attempting a DNS rebinding attack because it is querying a public domain that resolves to a private IP.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC analyst is investigating a possible denial-of-service attack. The capture shows a flood of IPv4 packets with the following characteristics: TTL=64, protocol=6 (TCP), source IP=203.0.113.5, destination IP=198.51.100.10, TCP flags=SYN, and the IP identification field increments by 1 for each packet. The analyst also notices that the TCP window size is consistently 1024. Which observation is most indicative of a crafted attack rather than a legitimate connection attempt?

   • AThe TTL value of 64 is consistent across all packets, which is typical of a single operating system.
   • BThe destination port is 80, which is a common target for SYN floods.
   • CThe IP identification field increments by 1 for each packet, which is normal for a single sender.
   • DThe TCP window size is consistently 1024, which is unusual for a SYN packet from a modern OS.
   Reveal Solution Discussion Select an answer first