Network and Log Investigations GCIH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   In a pcap, you see a TCP handshake to port 445, followed by an SMB negotiation, then a large data transfer from the client to the server. The client IP is a known compromised workstation. What is the most likely activity?

   • AData exfiltration from the server to the workstation.
   • BLateral movement using SMB to transfer a tool or payload to the server.
   • CA port scan of the server's SMB service.
   • DNormal file sharing activity by the user.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During an investigation, you open a pcap file and notice a series of TCP SYN packets sent to consecutive ports on a single host, each followed by an RST/ACK response. The source IP is consistent, and the packets span a few seconds. Which conclusion is best supported by this traffic pattern?

   • AA denial-of-service attack is flooding the target with SYN packets to exhaust its connection table.
   • BA port scan is in progress, and the target is responding with RST/ACK to indicate closed ports.
   • CA legitimate application is establishing multiple connections to different services on the same host.
   • DThe target is infected with malware that is beaconing to the source IP.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   You are analyzing a pcap that contains encrypted TLS traffic to a known malicious IP. You suspect data exfiltration but cannot decrypt the traffic. Which approach is most likely to provide useful evidence?

   • AAnalyze the TLS handshake and certificate details, and correlate the connection timing with other logs.
   • BDiscard the traffic because it is encrypted and cannot be analyzed.
   • CUse a packet reassembly tool to reconstruct the plaintext from the encrypted packets.
   • DAttempt to brute-force the TLS key by capturing more traffic.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During an incident, you need to collect a firewall log file from a Linux server for later analysis. What is the most appropriate method to preserve the evidence's integrity?

   • ACopy the log file to a USB drive and calculate a SHA-256 hash of the copy
   • BCalculate a SHA-256 hash of the original file, then copy it to a write-protected medium and hash the copy
   • CRun tcpdump on the server to capture new traffic and save it to a file
   • DCopy the log file to a network share and note the file size
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A pcap shows a series of TCP connections from an internal host to an external IP on port 53, but the packets are not standard DNS queries. The payloads are binary and the connections are short-lived. You suspect DNS tunneling. Which additional evidence would most strongly confirm this?

   • AThe connections occur during business hours only.
   • BThe DNS queries use long, random-looking subdomains and the responses contain encoded data.
   • CThe internal host is a DNS server.
   • DThe external IP is a known public DNS server like 8.8.8.8.
   Reveal Solution Discussion Select an answer first