Network Traffic Analysis GSOC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is inspecting a packet capture and sees an HTTP request with a User-Agent string that is extremely long and contains a series of unusual characters. The request is directed to a web application. What should the analyst do to determine if this is an attack?

   • ABlock all requests with unusual User-Agent strings.
   • BCheck the source IP reputation to decide if it is malicious.
   • CCompare the User-Agent string against known malicious patterns and check the response from the server.
   • DIgnore the User-Agent because it is not used by the application.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A company has a policy that all sensitive data must remain within the country's borders. They are considering using a cloud-based SIEM that ingests NetFlow data from their on-premises network. The SIEM provider offers regions in multiple countries. The company's network team is concerned about data sovereignty. Which action best addresses the concern?

   • AUse a private cloud for the SIEM to ensure data is isolated.
   • BSelect a SIEM region located within the required country and configure the NetFlow exporters to send data only to that region.
   • CEncrypt the NetFlow data before sending it to the SIEM.
   • DStore NetFlow data on-premises and only send aggregated summaries to the SIEM.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator is reviewing flow logs and notices that a server in the DMZ is sending a large amount of data to an internal database server on port 1433 (MSSQL) during non-business hours. The data transfer is significantly higher than normal. What is the most likely concern?

   • AThe server is compromised and is exfiltrating data from the database
   • BThe server is performing a routine software update
   • CThe server is experiencing a network issue causing retransmissions
   • DThe server is performing a legitimate database backup
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident investigation, an analyst needs to reconstruct the timeline of an attacker's activities on a compromised host. The analyst has NetFlow logs, DNS logs, and a full packet capture from the network perimeter. Which combination of data would provide the most complete timeline?

   • ADNS logs only, because they show which domains were visited.
   • BNetFlow logs only, because they show all connections.
   • CFull packet capture and DNS logs to correlate sessions with domain resolutions.
   • DFull packet capture only, because it contains everything.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a report of a workstation making outbound connections to a known malicious IP. The analyst needs to capture the traffic to and from that specific host without generating a large capture file. The workstation is on a switched network segment, and the analyst has administrative access to the workstation. Which approach should the analyst use?

   • AUse Wireshark on the workstation with a capture filter for port 80 and 443 only.
   • BConfigure a SPAN port on the switch and run Wireshark on the analyst's laptop to capture all traffic on the VLAN.
   • CRun tcpdump on the workstation with a BPF filter for the malicious IP and write the output to a ring buffer of 100 MB.
   • DDeploy a network TAP inline between the workstation and the switch and capture all traffic to a large disk.
   Reveal Solution Discussion Select an answer first