CySA+ Test Network Monitoring 3

Question 1

During network monitoring, an analyst identifies TCP sessions with the SYN flag set but no corresponding SYN-ACK responses from the destination. What does this pattern MOST likely indicate?

Accepted Answer

SYN scan (half-open scan) reconnaissance

Answer

TCP session hijacking

Answer

Established encrypted tunnels

Answer

ARP spoofing in progress

Question 2

Which SIEM use case BEST helps detect beaconing behavior from malware C2 communications?

Accepted Answer

Correlate periodic outbound connections to the same external IP at regular intervals

Answer

Alert on high-volume data transfers over HTTP

Answer

Block all outbound traffic on non-standard ports

Answer

Alert when DNS TTL exceeds 3600 seconds

Question 3

An analyst reviewing HTTPS traffic notices sessions with self-signed certificates issued by an unusual CA for a well-known financial site. What should the analyst suspect?

Accepted Answer

SSL inspection proxy or man-in-the-middle attack

Answer

Expired certificate misconfiguration

Answer

TLS downgrade attack

Answer

Certificate pinning bypass

Question 4

What does a high ratio of DNS TXT record queries to A/AAAA record queries from a single host MOST suggest?

Accepted Answer

DNS tunneling for C2 or exfiltration

Answer

Misconfigured DNS client

Answer

SPF/DKIM email validation activity

Answer

DNSSEC validation failures

Question 5

A network sensor captures traffic showing an internal host sending ARP replies claiming to be the default gateway, though it is not. Which attack does this indicate?

Accepted Answer

ARP poisoning / cache poisoning

Answer

IP spoofing

Answer

VLAN hopping

Answer

DHCP starvation

Question 6

When configuring SNMP monitoring for security purposes, which version should be used to ensure data confidentiality and authentication?

Accepted Answer

SNMPv3 with authPriv security level

Answer

SNMPv1

Answer

SNMPv2c

Answer

SNMPv3 with noAuthNoPriv security level

Question 7

An analyst is tasked with identifying hosts performing OS fingerprinting on the network. Which traffic characteristic is MOST indicative of passive OS fingerprinting attempts?

Accepted Answer

Capturing and analyzing TCP/IP stack behavior without sending probes

Answer

High ICMP echo request volume

Answer

Sending crafted TCP packets with unusual flag combinations

Answer

Large numbers of UDP packets to closed ports