2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   When analyzing a capture, which artifact would you correlate with a TCP stream to confirm that a file was downloaded?

   • AThe file extracted from the HTTP stream using Export Objects.
   • BThe DNS query for the server's IP address.
   • CThe ARP request for the server's MAC address.
   • DThe TCP handshake packets.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   While examining a pcap, you see a packet with a TCP destination port of 443 and a TLS ClientHello message. Which field in the ClientHello would you inspect to determine the server name the client is trying to reach?

   • AServer Name Indication (SNI) extension
   • BThe TCP sequence number
   • CThe IP header checksum
   • DThe TLS session ID
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   You are analyzing a pcap from a network breach. You see a TCP stream with an HTTP POST to a login page containing credentials, followed by a stream with a 302 redirect to a different domain, and then a stream with an HTTP GET to that domain with a session cookie. What is the most likely attack pattern?

   • AA DDoS attack.
   • BCredential theft and session hijacking.
   • CA DNS tunneling attack.
   • DA simple web browsing session.
   Reveal Solution Discussion Select an answer first
5. 39expert · medium

   An incident responder is analyzing a pcap file from a compromised host. The capture shows: (1) a TCP handshake to an external IP on port 445, (2) a series of SMB2 write requests, and (3) a subsequent HTTP POST to a different external IP. The responder needs to determine if the SMB traffic and the HTTP POST are related. Which approach is most effective?

   • ACheck if the SMB and HTTP connections occurred at the same time.
   • BLook for a DNS query for the HTTP destination IP.
   • CExtract the files written via SMB and compare their hashes to the data in the HTTP POST.
   • DAnalyze the SMB2 headers for the source and destination IPs.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   In a pcap, you see a TCP packet with the URG flag set and a Urgent Pointer value of 0. What is the most likely interpretation?

   • AThe packet is a TCP SYN flood.
   • BThe packet is malformed or an anomaly.
   • CThe packet is part of a normal file transfer.
   • DThe packet is a normal keep-alive.
   Reveal Solution Discussion Select an answer first