Protocol Attacks and Analysis GSOC Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   A security analyst is correlating events and sees a series of fragmented IP packets that, when reassembled, form a malicious payload targeting a web server. Shortly after, the server logs show an unusual error and a new outbound connection to an IRC server. Which multi-step attack does this correlation best describe?

   • ASimple port scan
   • BIDS evasion followed by exploitation and command-and-control
   • CARP poisoning attack
   • DDNS tunneling attack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A SOC analyst is reviewing DNS logs and notices a domain that resolves to different IP addresses in rapid succession, with each IP located in a different country. The domain is not on any blocklist. Which attack signature does this pattern most likely indicate?

   • AFast-flux DNS, used to hide the location of malicious servers behind a rotating set of compromised hosts.
   • BDNS cache poisoning, where forged responses redirect users to malicious IPs.
   • CA DNS amplification attack, where small queries generate large responses to a victim.
   • DDNS tunneling, where data is encoded in subdomain labels.
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   A network administrator sees a high volume of TCP packets with the RST flag set from a single external IP to various internal hosts. The packets are sent at a steady rate and do not correspond to any established connections. What is the most likely attack?

   • ATCP RST flood
   • BTCP sequence prediction attack
   • CTCP ACK flood
   • DTCP SYN flood
   Reveal Solution Discussion Select an answer first