200-201 practice questions 151–160

1. Question 151 · 334 in bank

   

   Refer to the exhibit. A security analyst is investigating unusual activity from an unknown IP address. Which type of evidence is this file?

   • Aindirect evidence
   • Bbest evidence
   • Cdirect evidence
   • Dcorroborative evidence

   Show answer

   Answer: A

   Explanation

   The given information "unusual activity from an unknown IP address" suggests that the evidence in question is indirect evidence, as it does not directly prove who is responsible for the activity, but rather provides a lead for further investigation. Indirect evidence is evidence that requires an inference to connect it to a conclusion, while direct evidence provides clear proof of a fact without requiring an inference.

   Source: Adapted from community discussion — drdecker100

   Next question

2. Question 152 · 334 in bank

   

   Refer to the exhibit. A network administrator is investigating suspicious network activity by analyzing captured traffic. An engineer notices abnormal behavior and discovers that the default user agent is present in the headers of requests and data being transmitted. What is occurring?

   • Aindicators of denial-of-service attack: due to the frequency of requests
   • Bindicators of data exfiltration: HTTP requests must be plain text
   • Ccache bypassing attack: attacker is sending requests for noncacheable content
   • Dgarbage flood attack: attacker is sending garbage binary data to open ports

   Show answer

   Answer: C

   Next question

3. Question 153 · 334 in bank

   

   Refer to the exhibit. An engineer received an event log file to review. Which technology generated the log?

   • AIDS/IPS
   • Bfirewall
   • Cproxy
   • DNetFlow

   Show answer

   Answer: B

   Next question

4. Question 154 · 334 in bank

   What does an attacker use to determine which network ports are listening on a potential target device?

   • Aman-in-the-middle
   • Bport scanning
   • CSQL injection
   • Dping sweep

   Show answer

   Answer: B

   Explanation

   "A port scanner is an application designed to probe a server or host for open ports. Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host and exploit vulnerabilities." source: https://en.wikipedia.org/wiki/Port_scanner So B is the correct answer

   Source: Adapted from community discussion — Leo_Visser

   Next question

5. Question 155 · 334 in bank

   

   Refer to the exhibit. An analyst was given a PCAP file, which is associated with a recent intrusion event in the company FTP server. Which display filters should the analyst use to filter the FTP traffic?

   • Adst.port = 21
   • Btcp.port == 21
   • Cdstport == FTP
   • Dtcpport = FTP

   Show answer

   Answer: B

   Next question

6. Question 156 · 334 in bank

   

   Refer to the exhibit. A workstation downloads a malicious .docx file from the Internet and a copy is sent to FTDv. The FTDv sends the file hash to FMC and the file event is recorded. What would have occurred with stronger data visibility?

   • AAn extra level of security would have been in place.
   • BMalicious traffic would have been blocked on multiple devices.
   • CThe traffic would have been monitored at any segment in the network.
   • DDetailed information about the data in real time would have been provided.

   Show answer

   Answer: D

   Explanation

   With stronger data visibility, the security team would have more detailed and real-time information about the malicious .docx file, allowing them to better detect, analyze, and respond to the threat. This could include more granular information about the file's characteristics, behavior, and network traffic patterns, as well as visibility across multiple devices and network segments. This could help to improve threat detection and response capabilities and enhance overall security posture. So, why not B? Option B could also be a possible answer, as stronger data visibility could enable multiple devices to block malicious traffic. However, option D more accurately describes the benefits of stronger data visibility in this specific scenario, as it mentions providing detailed information about the data in real time. Option D emphasizes the importance of having a comprehensive view of network traffic and being able to quickly identify and respond to potential threats.

   Source: Adapted from community discussion — itousattud

   Next question

7. Question 157 · 334 in bank

   

   Refer to the exhibit. Which frame numbers contain a file that is extractable via TCP stream within Wireshark?

   • A7 to 21
   • B7 and 21
   • C7, 14, and 21
   • D14, 16, 18, and 19

   Show answer

   Answer: D

   Next question

8. Question 158 · 334 in bank

   

   Refer to the exhibit. What is occurring?

   • ADNS tunneling
   • BDNS amplification
   • CARP poisoning
   • DARP flood

   Show answer

   Answer: A

   Explanation

   It's the same picture used in hack.lu CTF: Here the write-up (already mentioned by "weganos" in his comment) where it's explained the DNS tunnel technique: Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel (https://blog.stalkr.net/2010/10/hacklu-ctf-challenge-9-bottle-writeup.html)

   Source: Adapted from community discussion — Max_DeJaV

   Next question

9. Question 159 · 334 in bank

   

   Refer to the exhibit. An engineer is analyzing a PCAP file after a recent breach. An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access. How did the attacker gain access?

   • Aby using an SSH Tectia Server vulnerability to enable host-based authentication
   • Bby using brute force on the SSH service to gain access
   • Cby using the buffer overflow in the URL catcher feature for SSH
   • Dby using an SSH vulnerability to silently redirect connections to the local host

   Show answer

   Answer: B

   Explanation

   I don't know who is making this questions but this one is very tricky and with lack of information. Have no clue who select D as correct but the vulnerabilty described in D answe is very old and have affected SSH versions prior 2. From packet capture, the SSH v is 2 - so not vulnerable. About A answer, we can see from the packet capture the server is OpenSSH and not Tectia and also running on Linux (true that Tectia has some vulns for Linux/Unix but those are affecting versions 6.x) So the only remaining valid answer, IMHO, given the dozens of RST,ACK in such a short time, followed by a success connection is B - a brute force which succeeded

   Source: Adapted from community discussion — Silexis

   Next question

10. Question 160 · 334 in bank

    What describes a buffer overflow attack?

    • Asuppressing the buffers in a process
    • Binjecting new commands into existing buffers
    • Coverloading a predefined amount of memory
    • Dfetching data from memory buffer registers

    Show answer

    Answer: C

    Explanation

    Buffer Overflow Attack A Buffer Overflow (or buffer overrun) occurs when the volume of data exceeds the storage capacity of the memory buffer. https://www.imperva.com/learn/application-security/buffer-overflow/

    Source: Adapted from community discussion — SecurityGuy

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

200-201 practice, question 151. 334 questions available.