Network Intrusion Analysis

During an intrusion investigation, an analyst opens a PCAP in Wireshark and examines an Ethernet frame carrying an ARP packet. The frame's destination MAC address is ff:ff:ff:ff:ff:ff and the ARP opcode field value is 1. What is the analyst observing at this point in the capture?

While reviewing a suspicious PCAP in Wireshark, an analyst opens a single DNS packet and examines the query section. The Questions field shows one entry, the Name field contains 'a3f9c2e1b7d4.malwaredomain.example', and the Type field shows the value 16 (TXT). Given the objective of interpreting protocol header fields during intrusion analysis, what does this DNS record type most likely indicate about the traffic?

During intrusion analysis of a captured DNS transaction in Wireshark, an analyst inspects the DNS response header and notices the QR bit is set to 1, the ANCOUNT field shows a value of 8, and the RCODE field is 0. The queried hostname is a randomized 40-character subdomain of a suspicious external domain. Based on interpreting these header fields, what does the analyst most reasonably conclude?

An analyst has a PCAP of an HTTP session where a host downloaded a suspicious executable. Using Wireshark, the analyst needs to reconstruct and save the exact binary that was transferred so it can be submitted to a malware sandbox. Which Wireshark action correctly extracts the transferred file from the TCP stream?

A SOC analyst reviews an alert from an intrusion detection system that flagged inbound traffic to a web server as an active SQL injection attack. After investigation, the analyst confirms the traffic was a legitimate scheduled scan by the organization's authorized vulnerability assessment tool, and no actual malicious activity occurred. How should this alert be classified?

While reviewing a PCAP file in Wireshark, an analyst follows a TCP stream on port 21 and observes the following exchange: '220 ProFTPD Server ready', 'USER backup_svc', '331 Password required', 'PASS Wint3r2024!', '230 User logged in'. Based on this capture, what is the most significant intrusion-analysis concern the analyst should document?',

While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following request line: GET /download.php?file=../../../../etc/passwd HTTP/1.1 followed by a 200 OK response containing lines beginning with root:x:0:0. Interpreting the URI field in the request header, which intrusion is most likely occurring?

While reviewing a suspicious HTTP request captured in Wireshark, an analyst sees the following request headers: GET /admin/config.php HTTP/1.1 Host: 192.168.10.55 User-Agent: sqlmap/1.6.12#stable (https://sqlmap.org) Accept: */* Connection: close Which artifact element in these headers most directly identifies the nature of the activity as an automated attack?

While reviewing a PCAP in Wireshark, an analyst follows an HTTP stream and sees the following server reply to a client GET request: HTTP/1.1 200 OK Date: Tue, 14 May 2024 09:22:41 GMT Server: Apache/2.2.15 (CentOS) X-Powered-By: PHP/5.3.3 Content-Type: text/html; charset=UTF-8 Content-Length: 4821 Which intrusion-analysis conclusion is BEST supported by interpreting these HTTP response header fields?

While reviewing a suspicious PCAP in Wireshark, an analyst isolates a series of ICMP packets flowing from an internal host to an external IP. Each packet shows a Type value of 8 and a Code value of 0, and the data portion of each packet is unusually large and contains non-standard, high-entropy bytes rather than the typical repeating alphabet pattern. What does the interpretation of these ICMP header fields most likely indicate?

While analyzing a suspicious packet in Wireshark, an analyst notices an inbound packet from an external host with an IP header Time-to-Live (TTL) value of 45. The analyst knows the packet has traversed roughly 19 routers before reaching the sensor. In the context of intrusion analysis, what is the MOST useful inference the analyst can draw from interpreting this TTL field?

While analyzing a suspicious PCAP, an analyst notices multiple IPv4 packets from a single source that each carry the More Fragments (MF) flag set and non-zero Fragment Offset values, but the reassembled payloads produce overlapping byte ranges. Based on interpreting these IPv4 header fields, what is the most likely purpose of this traffic?

During a security review, an analyst reads the following log line: 'Threat detected: Win32/Emotet in C:\Users\jsmith\Downloads\invoice.exe — Action taken: Quarantined. Signature version 1.389.204.0.' The analyst must map this event to the correct source technology so it can be correlated with other data. Which source technology most likely produced this event?

A SOC analyst receives a data feed showing records with source IP, destination IP, source and destination ports, protocol number, byte counts, packet counts, and start/end timestamps for each conversation — but no application-layer payload. The feed originates from the organization's edge router. When mapping this event data to its source technology, which technology most likely produced these records?

A SOC analyst is reviewing a suspected data exfiltration incident. The security team asks whether the current monitoring architecture allows them to reconstruct the actual contents of the files that left the network. The organization currently collects only NetFlow records exported from its core routers and does not maintain any packet capture appliances. Which statement BEST describes the analytical limitation of relying solely on this NetFlow data for this investigation?

During an investigation, an analyst needs to determine the exact HTTP URI and file content that a suspicious internal host requested from an external server. The SOC has access to both a NetFlow collector and a full-visibility SPAN/tap feed captured to PCAP. Which statement correctly compares what each data source can provide for this specific need?

A network engineer reviews two firewall designs. Firewall A evaluates each packet independently against a static ruleset and has no memory of prior packets. Firewall B tracks the state of active connections in a connection table and automatically permits return traffic that belongs to an established session. During analysis of an outbound TCP session initiated by an internal host, which statement correctly describes how each firewall handles the inbound reply packets?

A SOC analyst is building a detection filter to flag proxy log entries where users downloaded potentially malicious executable or script files. The analyst writes the regular expression: \.(exe|dll|ps1|bat)$ to match against the requested URL path. Which of the following filenames would this regex match?

A SOC analyst wants to filter proxy logs to isolate entries where a URL query string contains a hexadecimal value of exactly 32 characters (a possible MD5 hash used as a tracking or exfiltration token). Which regular expression will match ONLY a standalone 32-character hex string and reject strings that are longer or shorter?

An analyst is filtering web server logs to find requests where the URI path ends with a status code between 500 and 599 (server errors). They write the following grep expression against lines that end with the status code: grep -E ' 5[0-9]{2}$' access.log. Which set of trailing status codes will this regular expression match?