Protocol Attacks and Analysis GSOC Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is monitoring a web application and sees a series of HTTP requests with the following pattern: the first request is a normal GET, followed by several requests with the same session ID but different User-Agent strings, and then a request with a very long Cookie header. The application is behind a load balancer. Which attack signature is most likely being observed?

   • AHTTP request smuggling, where conflicting headers are used to bypass the load balancer.
   • BSession hijacking, where an attacker uses a stolen session ID and changes User-Agent to evade detection.
   • CSession fixation, where an attacker sets a known session ID for a victim.
   • DCross-site scripting, where malicious scripts are injected into the application.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network defender is analyzing a pcap and notices a series of ICMP Echo Request packets with payloads that contain repeating patterns of 'A' characters. The source IP is spoofed. Which attack signature does this pattern most strongly suggest?

   • AICMP tunneling, where data is hidden in the payload of ICMP packets.
   • BICMP redirect attack, where a malicious router is advertised.
   • CSmurf attack, where ICMP is sent to a broadcast address.
   • DPing of death, where oversized ICMP packets cause a crash.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst notices a large volume of UDP packets from many different source IPs to a single destination IP on port 53. The packets are small, but the responses are large. The destination IP is not a DNS server. Which attack is most likely occurring?

   • ADNS amplification, where spoofed queries are sent to open resolvers to flood a victim.
   • BUDP flood, where high volumes of UDP packets are sent to random ports.
   • CNTP amplification, where monlist requests are sent to NTP servers.
   • DDNS cache poisoning, where forged responses are sent to a resolver.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is examining a pcap file and sees a series of TCP segments with the URG flag set and a non-zero urgent pointer. The payload contains repeated bytes that resemble a known exploit string. Which protocol analysis technique would best confirm whether this is a real attack or a false positive?

   • ACheck the TCP sequence numbers for retransmissions
   • BCount the number of SYN packets to the same destination
   • CReassemble the TCP stream and inspect the urgent data in context
   • DVerify the IP checksum of each packet
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is investigating a series of events: (1) a single internal host sends a TCP SYN to an external server; (2) the server responds with SYN-ACK; (3) the internal host sends an ACK; (4) then the internal host sends a series of TCP packets with the PSH flag and a payload that matches a known exploit signature; (5) the server responds with a 200 OK. The analyst must determine if this is an attack. Which additional evidence would most strongly indicate an attack?

   • AThe exploit signature is a false positive
   • BThe server's response contains a shell session
   • CThe internal host is not authorized to communicate with the external server
   • DThe internal host is a known vulnerable server
   Reveal Solution Discussion Select an answer first