Data on the Network GBFA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   During network traffic analysis, which of the following is a common indicator of a potential data exfiltration attempt?

   • AA large outbound data transfer to an unusual external IP address
   • BA steady stream of ICMP echo replies from a local server
   • CA high number of DNS queries to a well-known public DNS server
   • DFrequent ARP requests within the local subnet
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An examiner is analyzing a packet capture and sees a large number of UDP packets to port 53 on an internal DNS server. The packets have varying source ports and contain encoded data in the query names. What is the most likely activity?

   • ANormal DNS resolution for a large number of domains.
   • BA DNS amplification attack against the internal server.
   • CDNS tunneling used to exfiltrate data.
   • DA misconfigured application sending DNS updates.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   You are analyzing a pcap and notice a large number of TCP SYN packets sent to a single IP address on port 80. The source IPs are spoofed and the SYN packets are sent at a very high rate. The target is responding with SYN-ACK packets, but the source IPs are not completing the handshake. What is the most likely purpose of this traffic?

   • AA port scan using SYN packets to identify open ports.
   • BA misconfigured router sending SYN packets in a loop.
   • CA SYN flood attack designed to exhaust the target's connection table.
   • DA normal TCP connection attempt from many clients.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   While analyzing a pcap, you notice a TCP connection where the initial sequence number (ISN) is predictable and follows a pattern based on the previous connection's ISN. What is the potential security implication?

   • AThe connection is using a non-standard TCP implementation that is more secure.
   • BThe connection is vulnerable to TCP sequence prediction attacks, allowing an attacker to spoof packets.
   • CThe connection is encrypted, so the ISN pattern is irrelevant.
   • DThe connection is part of a DDoS attack.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst is reviewing a packet capture from a corporate network and observes a large volume of DNS queries for random subdomains under a single domain that the company does not own. The queries originate from a single internal host. What is the most likely explanation?

   • AThe host is infected with malware using DNS as a covert communication channel.
   • BThe host is running a misconfigured web browser that is prefetching links.
   • CThe host is performing a legitimate DNS-based load balancing check.
   • DThe host is experiencing a DNS cache poisoning attack.
   Reveal Solution Discussion Select an answer first