Intrusion Detection and Packet Analysis GCED Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is investigating a report of a compromised workstation. The analyst captures traffic on the workstation's network segment and observes a large volume of TCP SYN packets sent to a single external IP address across a wide range of destination ports, with no corresponding SYN-ACK replies. The analyst also notices that the workstation is sending a steady stream of small UDP packets to the same external IP address. Which conclusion is best supported by this traffic pattern?

   • AThe workstation is performing a port scan of the external host, and the UDP traffic indicates a separate data exfiltration channel.
   • BThe workstation is likely participating in a distributed denial-of-service (DDoS) attack, and the UDP traffic may be part of the attack or a covert exfiltration channel.
   • CThe workstation is infected with malware that is scanning for vulnerable services on the external host, and the UDP traffic is a normal response to the SYN packets.
   • DThe workstation is experiencing a network misconfiguration causing it to send both TCP and UDP traffic to the same IP, which is a common benign behavior.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A security team is evaluating IDS detection methods for a network that experiences frequent false positives from signature-based alerts. The team needs to reduce false positives while still detecting known attacks and novel variants. They have a large dataset of normal traffic and a smaller dataset of known attack traffic. Which approach best balances these requirements?

   • AReplace the signature-based IDS with an anomaly-based IDS that uses a baseline of normal traffic
   • BKeep the signature-based IDS and tune the signatures to reduce false positives, while adding anomaly-based detection for novel variants
   • CDisable all signatures and rely on manual traffic analysis
   • DUse only stateful protocol analysis to detect protocol violations
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which technique is commonly used by attackers to evade signature-based IDS by splitting malicious payloads across multiple small packets?

   • AFragmentation
   • BTiming attacks
   • CObfuscation
   • DEncryption
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SOC analyst is reviewing a burst of IDS alerts from the perimeter. The alerts include: (1) multiple ICMP echo requests from 198.51.100.7 to various internal hosts, (2) TCP SYN packets from the same IP to port 22 on several internal servers, and (3) a successful SSH login from 198.51.100.7 to a jump host. The analyst must decide whether these are separate incidents or one coordinated attack. Which action best applies alert correlation to this situation?

   • AIgnore the ICMP and SYN alerts because the SSH login succeeded and is the only actionable event
   • BTreat each alert as an independent event and open separate tickets to avoid missing any detail
   • CCorrelate the alerts by source IP and timeline, and treat them as a single multi-step reconnaissance-to-access campaign
   • DBlock the source IP immediately and close all alerts without further analysis
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which type of intrusion detection system is best suited to monitor traffic crossing a network segment between two internal subnets?

   • AApplication-based IDS
   • BWireless IDS (WIDS)
   • CNetwork-based IDS (NIDS)
   • DHost-based IDS (HIDS)
   Reveal Solution Discussion Select an answer first