Network Traffic Analysis GSOC Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   An analyst is examining a pcap and sees a TCP handshake with the SYN flag, followed by a PSH-ACK packet containing data, and then a FIN-ACK. The data in the PSH-ACK packet is a single HTTP GET request. The analyst notices that the source IP is a known scanner. What does this pattern indicate?

   • AThe scanner is performing a SYN scan and did not complete the handshake.
   • BThe scanner is performing a FIN scan to check for open ports.
   • CThe scanner completed a full TCP connection and sent an HTTP request, indicating a full connect scan or a vulnerability scan.
   • DThe scanner is performing a UDP scan.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of packet inspection in network security?

   • ATo examine packet contents for signs of malicious activity or attack signatures
   • BTo encrypt network traffic to protect confidentiality
   • CTo compress network traffic to improve performance
   • DTo block all traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During an incident response, an analyst has a pcap file that contains traffic from a compromised host. The analyst needs to determine the exact time when the attacker first accessed the host. The pcap contains traffic from multiple days. What is the most efficient way to find the first packet from the attacker's IP address?

   • AUse a flow analysis tool to identify the first connection from the attacker's IP
   • BUse Wireshark's 'Find Packet' feature to search for the attacker's IP address
   • CUse tcpdump to filter for the attacker's IP and write the output to a file
   • DUse tshark to filter for the attacker's IP and display the first packet's timestamp
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is investigating a suspected data exfiltration and has a pcap file. The analyst notices that the traffic is encrypted (TLS). The analyst has access to the private key of the server that the traffic is destined to. What is the best way to decrypt and analyze the traffic?

   • AUse tcpdump to capture the traffic and then use openssl to decrypt it
   • BUse Wireshark's 'Decrypt TLS' feature and provide the server's private key
   • CUse Wireshark's 'Follow TLS Stream' feature to view the decrypted data
   • DUse a tool like ssldump to decrypt the traffic
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst is inspecting a packet capture and sees a TCP connection to a server on port 3389 (RDP). The connection is from an external IP and the analyst notices that the RDP traffic is encrypted. The analyst suspects an attempted RDP brute force. Which evidence in the capture would best support this?

   • AMultiple TCP connections from the same external IP to port 3389 with different source ports in a short time.
   • BThe RDP traffic contains a large number of NULL packets.
   • CA single TCP connection that stays open for a long time.
   • DThe source IP is in a different country.
   Reveal Solution Discussion Select an answer first