CySA+ Test Network Monitoring 2

Question 1

A security analyst notices a spike in ICMP echo requests from a single internal host to hundreds of external IPs within 60 seconds. What is the MOST likely explanation?

Accepted Answer

ICMP flood DDoS participation

Answer

A single host sending ICMP traffic to many external destinations at high volume is characteristic of participating in a distributed ICMP flood DDoS attack.

Question 2

Which NetFlow field is MOST useful for identifying lateral movement between internal hosts?

Accepted Answer

Source and destination IP pairs with byte counts

Answer

Internal source/destination IP pairs with associated byte counts reveal east-west traffic patterns indicative of lateral movement.

Question 3

An analyst sees repeated DNS queries for the same non-existent domain with slight character variations. Which attack technique does this BEST describe?

Accepted Answer

Domain generation algorithm (DGA) malware

Answer

DGA malware generates many pseudo-random domain names to find active C2 servers, producing repeated NXDOMAIN responses with character variations.

Question 4

A SIEM correlation rule fires when more than 10 failed logins occur for one account within 5 minutes. An analyst reviews alerts and finds 9 failed logins followed by success. What should the analyst do FIRST?

Accepted Answer

Investigate the successful login for signs of compromise

Answer

A successful login immediately following multiple failures strongly suggests a successful brute-force and warrants immediate investigation of that session.

Question 5

Which protocol should be monitored to detect exfiltration via seemingly legitimate traffic using long TTL responses to encode data?

Accepted Answer

DNS

Answer

DNS tunneling encodes data in query/response fields including TTL values, making DNS monitoring critical for detecting this exfiltration technique.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Network Monitoring 2