Protocol Attacks and Analysis GSOC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network analyst sees a series of UDP packets from an internal host to a remote server with the same source and destination ports, and the payload contains a repeated pattern that matches a known DNS amplification signature. The packets are sent at a steady rate. What should the analyst do first to confirm the attack?

   • ACheck if the UDP payload is a valid DNS query with a spoofed source IP
   • BVerify the Ethernet frame checksums
   • CLook for TCP handshakes to the same destination
   • DBlock the internal host's IP address immediately
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst is examining a pcap file and sees a TCP stream with the ACK flag set on every packet, including the initial packet of the connection. The sequence numbers are not incrementing as expected. Which protocol analysis technique would best confirm whether this is a legitimate TCP session or a crafted attack?

   • ALook for retransmissions to see if any packets were lost during the session.
   • BCheck the source and destination MAC addresses to ensure they match the expected hosts.
   • CCount the number of packets per second to see if the traffic exceeds a baseline threshold.
   • DVerify that the three-way handshake completes with correct SYN, SYN-ACK, and ACK flags before data transfer begins.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is reviewing HTTP traffic and sees a series of requests to a web application with URLs containing long strings of percent-encoded characters. The application logs show some requests returned a 500 error. Which protocol attack is most likely being attempted?

   • AHTTP response splitting, where CRLF injection is used to add headers.
   • BDirectory traversal, where ../ sequences are encoded to access files outside the web root.
   • CHTTP request smuggling, where conflicting Content-Length and Transfer-Encoding headers are used.
   • DSlowloris, where incomplete HTTP requests are sent slowly to exhaust connections.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A security analyst observes a TCP handshake where the client sends a SYN packet, the server responds with SYN-ACK, and the client never sends the final ACK. The client repeats this behavior with many different destination ports on the same host. Which type of protocol attack does this traffic pattern most directly indicate?

   • ATCP port scan
   • BTCP session hijacking
   • CTCP reset attack
   • DTCP SYN flood
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC analyst is correlating events from multiple sources: firewall logs show a spike in outbound connections to a known malicious IP, DNS logs show a query for a domain that resolves to that IP, and endpoint logs show a process making HTTP requests to the same domain. The analyst must determine the root cause and scope of the compromise. Which correlation would be most effective?

   • ASearch the DNS logs for other queries to the same domain to identify all affected hosts.
   • BIsolate the endpoint that made the HTTP requests to prevent further spread.
   • CCorrelate the firewall, DNS, and endpoint logs by the domain name and time to identify the affected hosts and the malware's behavior.
   • DBlock the malicious IP in the firewall to stop the outbound connections.
   Reveal Solution Discussion Select an answer first