Protocol Attacks and Analysis GSOC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst sees a series of alerts: first, a port scan from an external IP; then, a successful SSH login from the same IP to a jump host; and finally, lateral movement to an internal database server. Which event correlation technique would best confirm that these events are part of a single multi-step attack?

   • AVerify that all events occurred on the same day of the week.
   • BCheck the destination ports of each event to see if they are commonly used together.
   • CLook for the same user agent string in all three events.
   • DGroup the events by the source IP and time window, then map them to the MITRE ATT&CK kill chain.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization experiences the following sequence of events: (1) a single internal host sends a TCP SYN to an external server; (2) the server responds with SYN-ACK; (3) the internal host sends an ACK; (4) the internal host sends a series of TCP packets with the PSH flag and a payload that matches a known exploit signature; (5) the server responds with a 200 OK; (6) the internal host sends a TCP RST. The analyst must determine if this is an attack. Which additional evidence would most strongly indicate a false positive?

   • AThe exploit signature is also present in legitimate traffic
   • BThe server's response contains a shell session
   • CThe internal host is a known vulnerable server
   • DThe internal host is not authorized to communicate with the external server
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization's SIEM shows a spike in outbound DNS queries from a single workstation to a rarely-used internal DNS server, each query having a long subdomain. The workstation also shows a large amount of data sent to an external IP over HTTPS. Which correlation would most likely identify the attack?

   • ALook for a matching increase in inbound DNS responses to the workstation.
   • BCorrelate the DNS queries with the HTTPS traffic to see if the DNS queries are encoding data that matches the HTTPS payload.
   • CCheck if the DNS server is configured to allow recursive queries from the workstation.
   • DVerify that the workstation's DNS cache is not corrupted.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is examining a pcap that shows a TCP connection with the following characteristics: the initial packet has the SYN and ACK flags set, the sequence numbers are random, and the window size is 0. The connection is to a database server on port 1433. The analyst must determine if this is a legitimate connection or an attack. Which analysis would be most conclusive?

   • ALook for a matching response from the database server to see if it completes the handshake.
   • BVerify that the TCP handshake follows the expected SYN, SYN-ACK, ACK sequence.
   • CAnalyze the payload of the first packet to see if it contains SQL commands.
   • DCheck if the source IP is in the organization's approved database client list.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing a pcap and sees a TCP packet with the ACK flag set, an acknowledgment number that is not in the expected range, and a payload that contains a known exploit string. The packet is part of an established connection. What should the analyst do to determine if this is a real attack?

   • AIgnore the packet because the ACK number is invalid
   • BBlock the source IP immediately
   • CReassemble the TCP stream and verify the exploit string is actually delivered
   • DCheck if the packet is a retransmission
   Reveal Solution Discussion Select an answer first