CCD Network Defense & Monitoring 2 — Questions and Answers
Question 1: A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names. Which attack technique does this most likely indicate?
- DNS cache poisoning
- Domain generation algorithm (DGA) malware (Correct answer)
- DNS amplification attack
- Zone transfer attempt
Correct answer: Domain generation algorithm (DGA) malware
DGA malware generates large numbers of pseudo-random domain names to locate C2 servers, producing the characteristic spike in DNS queries.
Question 2: Which NetFlow field is MOST useful for detecting port scanning activity on a network?
- Bytes transferred per flow
- Number of unique destination ports per source IP (Correct answer)
- Flow duration
- TTL value
Correct answer: Number of unique destination ports per source IP
Port scanning produces many short flows to unique destination ports from a single source, making destination port diversity the key indicator.
Question 3: A network defender wants to detect lateral movement using Windows Event Logs. Which Event ID is most relevant for tracking pass-the-hash attacks?
- 4624 with Logon Type 3 (Correct answer)
- 4648
- 4720
- 4776
Correct answer: 4624 with Logon Type 3
Event ID 4624 with Logon Type 3 (network logon) using NTLM authentication is the primary indicator of pass-the-hash lateral movement.
Question 4: What is the primary purpose of a network tap compared to a SPAN port for traffic monitoring?
- Taps filter traffic before forwarding to the sensor
- Taps provide full-duplex traffic capture without affecting the monitored link (Correct answer)
- Taps only capture inbound traffic
- Taps require more bandwidth than SPAN ports
Correct answer: Taps provide full-duplex traffic capture without affecting the monitored link
Network taps passively copy all traffic on a link in both directions without impacting performance, unlike SPAN ports which can drop packets under load.
Question 5: An IDS generates an alert every time a legitimate vulnerability scanner runs on the network. This is an example of:
- True positive
- False negative
- False positive (Correct answer)
- True negative
Correct answer: False positive
A false positive occurs when the IDS flags benign activity — in this case, an authorized scanner — as malicious.
Question 6: Which protocol should be disabled on managed switches to prevent VLAN hopping attacks?
- OSPF
- STP
- DTP (Dynamic Trunking Protocol) (Correct answer)
- CDP
Correct answer: DTP (Dynamic Trunking Protocol)
DTP allows switches to automatically negotiate trunk links; disabling it prevents attackers from establishing rogue trunks to access multiple VLANs.
Question 7: A defender observes periodic beaconing traffic at exact 60-second intervals to an external IP. What characteristic makes this suspicious?
- High data volume per beacon
- Consistent, machine-like timing intervals (Correct answer)
- Use of TCP protocol
- Traffic to a well-known CDN
Correct answer: Consistent, machine-like timing intervals
Perfectly regular, machine-driven timing intervals are a hallmark of C2 beaconing, as humans produce irregular traffic patterns.
CCD Network Defense & Monitoring 2
A SOC analyst notices a spike in outbound DNS queries to randomly generated domain names.
Which attack technique does this most likely indicate?