2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reviewing a pcap file and notices a large number of TCP SYN packets sent to a single host from many different source IP addresses, but no SYN-ACK responses. What is the most likely explanation?

   • AThe target host is performing a port scan.
   • BA TCP SYN flood attack is in progress.
   • CA normal TCP connection establishment is occurring.
   • DThe packets are part of a UDP flood.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You are analyzing a pcap and see a TCP stream that contains an HTTP POST request with a username and password in the body. You also see a subsequent stream that contains an HTTP 200 response with a session cookie. What is the most likely sequence of events?

   • AThe user's session was terminated.
   • BThe user uploaded a file to the server.
   • CThe user logged in and received a session cookie.
   • DThe user downloaded a file from the server.
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   A forensic analyst is examining a pcap file and finds an HTTP stream that contains a file upload. The analyst extracts the file, but the file appears to be a PNG image with a .jpg extension. What should the analyst do next?

   • ARename the file to .png and open it to verify it is a valid image.
   • BSubmit the file to a sandbox for analysis.
   • CDelete the file because it is corrupted.
   • DRun a hex dump to see if the file contains hidden data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   You are analyzing a pcap and find a TCP stream that contains a base64-encoded string. After decoding, you get a URL that points to a file. You also see a subsequent HTTP GET request to that URL. What is the most likely sequence?

   • AThe attacker is sending a phishing email.
   • BThe attacker used the decoded URL to download a second-stage payload.
   • CThe attacker is uploading a file to a server.
   • DThe attacker is performing a DNS query.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which Wireshark feature highlights potential network problems or anomalies, such as retransmissions or malformed packets, in the packet list?

   • AStatistics > Conversations
   • BCapture > Restart
   • CExpert Info
   • DTelephony > VoIP Calls
   Reveal Solution Discussion Select an answer first