CySA+ Test Network Monitoring 2 — Questions and Answers
Question 1: A security analyst notices a spike in ICMP echo requests from a single internal host to hundreds of external IPs within 60 seconds. What is the MOST likely explanation?
- ICMP flood DDoS participation (Correct answer)
- Network discovery scan
- Ping sweep reconnaissance
- Routing table corruption
Correct answer: ICMP flood DDoS participation
A single host sending ICMP traffic to many external destinations at high volume is characteristic of participating in a distributed ICMP flood DDoS attack.
Question 2: Which NetFlow field is MOST useful for identifying lateral movement between internal hosts?
- Source and destination AS numbers
- Source and destination IP pairs with byte counts (Correct answer)
- TCP window size
- DSCP markings
Correct answer: Source and destination IP pairs with byte counts
Internal source/destination IP pairs with associated byte counts reveal east-west traffic patterns indicative of lateral movement.
Question 3: An analyst sees repeated DNS queries for the same non-existent domain with slight character variations. Which attack technique does this BEST describe?
- DNS amplification
- DNS cache poisoning
- Domain generation algorithm (DGA) malware (Correct answer)
- DNS zone transfer abuse
Correct answer: Domain generation algorithm (DGA) malware
DGA malware generates many pseudo-random domain names to find active C2 servers, producing repeated NXDOMAIN responses with character variations.
Question 4: A SIEM correlation rule fires when more than 10 failed logins occur for one account within 5 minutes. An analyst reviews alerts and finds 9 failed logins followed by success. What should the analyst do FIRST?
- Close the alert as below threshold
- Investigate the successful login for signs of compromise (Correct answer)
- Tune the rule threshold to 8
- Block the source IP immediately
Correct answer: Investigate the successful login for signs of compromise
A successful login immediately following multiple failures strongly suggests a successful brute-force and warrants immediate investigation of that session.
Question 5: Which protocol should be monitored to detect exfiltration via seemingly legitimate traffic using long TTL responses to encode data?
- HTTPS
- DNS (Correct answer)
- SMTP
- SNMP
Correct answer: DNS
DNS tunneling encodes data in query/response fields including TTL values, making DNS monitoring critical for detecting this exfiltration technique.
Question 6: An organization uses full packet capture (PCAP). When analyzing a suspected data exfiltration event, what is the PRIMARY advantage of PCAP over NetFlow?
- Lower storage requirements
- Faster alerting
- Ability to inspect payload content (Correct answer)
- Better support for encrypted traffic
Correct answer: Ability to inspect payload content
PCAP captures full packet contents, allowing analysts to examine actual payload data to confirm what information was transmitted.
Question 7: A baseline shows an internal server generates 500 MB of outbound traffic daily. Monitoring shows 4.8 GB outbound on a Saturday. Which network monitoring concept does reviewing this represent?
- Signature-based detection
- Anomaly-based detection (Correct answer)
- Protocol analysis
- Heuristic scanning
Correct answer: Anomaly-based detection
Comparing current traffic volume against an established baseline to identify deviations is the core principle of anomaly-based detection.
CySA+ Test Network Monitoring 2
A security analyst notices a spike in ICMP echo requests from a single internal host to hundreds of external IPs within 60 seconds.
What is the MOST likely explanation?