Protocol Attacks and Analysis GSOC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is examining a pcap and sees a TCP packet with the FIN flag set, but the packet is not part of an established connection. The packet has a payload that contains a known exploit string. What should the analyst do to determine if this is an attack?

   • ACheck if the packet is a retransmission
   • BLook for a corresponding SYN packet
   • CReassemble the TCP stream to see if the payload is delivered
   • DTreat it as a potential attack and investigate the payload
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network analyst sees a high volume of UDP packets from a single external IP to a single internal host on port 53. The payloads are all DNS queries with random subdomains. What is the most likely attack?

   • ADNS tunneling
   • BDNS amplification attack
   • CDNS flood
   • DUDP flood
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst is reviewing captured traffic and notices a series of TCP packets with the URG flag set and urgent pointer values that are unusually large. Which protocol-specific attack signature does this pattern most likely represent?

   • ATCP sequence number prediction
   • BTCP SYN flood
   • CTCP urgent data injection
   • DTCP window scaling attack
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is analyzing a pcap and sees a series of TCP packets with the same sequence number but different payloads. The packets are sent from different source IPs to the same destination. What protocol analysis technique should the analyst use to identify the attack?

   • ACompare the sequence numbers to the expected values based on the handshake
   • BLook for a TCP handshake from each source IP
   • CCheck the IP TTL values for anomalies
   • DReassemble the TCP stream from each source IP separately
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization sees the following events: (1) a single external IP sends a TCP SYN to an internal host on port 22; (2) the internal host responds with SYN-ACK; (3) the external IP sends an ACK and then a series of SSH authentication attempts; (4) after several attempts, the external IP sends a TCP RST. This pattern repeats from the same IP to multiple internal hosts. What is the most likely attack?

   • APort scan
   • BMan-in-the-middle attack
   • CSSH brute-force attack
   • DTCP SYN flood
   Reveal Solution Discussion Select an answer first