Protocol Attacks and Analysis GSOC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC team is investigating a series of alerts: (1) a port scan from IP 203.0.113.5, (2) a successful SSH login to a bastion host from the same IP, (3) an internal port scan from the bastion host, and (4) a large outbound data transfer from a database server. The team has limited analyst time and must prioritize which events to investigate. Which approach would most efficiently confirm whether these events are part of a single attack campaign?

   • AInvestigate the outbound data transfer first, as it indicates the most severe impact.
   • BIsolate the database server to prevent further data loss.
   • CBlock the source IP 203.0.113.5 immediately to stop further activity.
   • DCorrelate all four events by source IP and time, then map them to the kill chain to identify the attack progression.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC analyst is reviewing network traffic and sees a series of HTTP requests to a web server with the following pattern: the first request is a normal GET, followed by a request with a very long URL containing encoded characters, and then a request with a different HTTP method (e.g., PUT) to the same resource. The web server is behind a WAF. Which attack signature is most likely being observed?

   • AA directory brute-force attack, where many paths are tried to find hidden resources.
   • BHTTP request smuggling, where conflicting headers are used to bypass the WAF.
   • CA WAF bypass attempt, where the attacker uses encoding and method changes to evade detection.
   • DHTTP parameter pollution, where multiple parameters are sent to confuse the application.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a potential TCP session hijack. The analyst has a pcap of the session. Which protocol analysis technique would provide the most direct evidence of session hijacking?

   • AExamine the TCP sequence and acknowledgment numbers to see if they jump unexpectedly during the session.
   • BCheck the TCP window size to see if it is larger than the default.
   • CLook for TCP options like SACK or timestamps in the packets.
   • DCount the number of packets in the session to see if it is unusually high.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst is correlating network events and observes the following sequence: (1) a TCP port scan from an external IP, (2) a successful SSH login from the same IP, (3) outbound data transfers to an unknown server. Which multi-step protocol attack does this event correlation most likely indicate?

   • AARP spoofing attack
   • BReconnaissance followed by exploitation and data exfiltration
   • CDenial-of-service attack
   • DMan-in-the-middle attack
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network administrator is troubleshooting a performance issue on a critical server. The server is receiving a high volume of TCP SYN packets, but the connection queue is not filling up, and the server remains responsive. The administrator suspects a SYN flood but is not sure. Which analysis would best determine if this is a SYN flood or a legitimate connection burst?

   • ACheck if the SYN packets are coming from a single source IP or multiple source IPs.
   • BCount the number of SYN packets per second and compare it to the baseline.
   • CExamine the TCP handshake completion rate to see if many SYN packets are not followed by SYN-ACK or ACK.
   • DLook at the destination port to see if it is a common service port.
   Reveal Solution Discussion Select an answer first