CySA+ Test Network Monitoring 3 — Questions and Answers
Question 1: During network monitoring, an analyst identifies TCP sessions with the SYN flag set but no corresponding SYN-ACK responses from the destination. What does this pattern MOST likely indicate?
- TCP session hijacking
- SYN scan (half-open scan) reconnaissance (Correct answer)
- Established encrypted tunnels
- ARP spoofing in progress
Correct answer: SYN scan (half-open scan) reconnaissance
A SYN scan sends SYN packets but never completes the handshake; unanswered SYNs are characteristic of port scanning with half-open connections.
Question 2: Which SIEM use case BEST helps detect beaconing behavior from malware C2 communications?
- Alert on high-volume data transfers over HTTP
- Correlate periodic outbound connections to the same external IP at regular intervals (Correct answer)
- Block all outbound traffic on non-standard ports
- Alert when DNS TTL exceeds 3600 seconds
Correct answer: Correlate periodic outbound connections to the same external IP at regular intervals
Malware beaconing is characterized by regular, periodic outbound connections to a C2 server, which correlation rules can identify by timing patterns.
Question 3: An analyst reviewing HTTPS traffic notices sessions with self-signed certificates issued by an unusual CA for a well-known financial site. What should the analyst suspect?
- Expired certificate misconfiguration
- TLS downgrade attack
- SSL inspection proxy or man-in-the-middle attack (Correct answer)
- Certificate pinning bypass
Correct answer: SSL inspection proxy or man-in-the-middle attack
A self-signed or unusual CA certificate for a known site often indicates an SSL inspection proxy or an active MITM attack intercepting the connection.
Question 4: What does a high ratio of DNS TXT record queries to A/AAAA record queries from a single host MOST suggest?
- Misconfigured DNS client
- SPF/DKIM email validation activity
- DNS tunneling for C2 or exfiltration (Correct answer)
- DNSSEC validation failures
Correct answer: DNS tunneling for C2 or exfiltration
DNS tunneling tools frequently use TXT records to encode large payloads, so an unusually high TXT-to-A query ratio from one host warrants investigation.
Question 5: A network sensor captures traffic showing an internal host sending ARP replies claiming to be the default gateway, though it is not. Which attack does this indicate?
- IP spoofing
- ARP poisoning / cache poisoning (Correct answer)
- VLAN hopping
- DHCP starvation
Correct answer: ARP poisoning / cache poisoning
Sending unsolicited ARP replies that falsely associate the attacker's MAC with the gateway IP is the defining behavior of ARP poisoning.
Question 6: When configuring SNMP monitoring for security purposes, which version should be used to ensure data confidentiality and authentication?
- SNMPv1
- SNMPv2c
- SNMPv3 with authPriv security level (Correct answer)
- SNMPv3 with noAuthNoPriv security level
Correct answer: SNMPv3 with authPriv security level
SNMPv3 with the authPriv security level provides both authentication (message integrity) and encryption (confidentiality) for SNMP communications.
Question 7: An analyst is tasked with identifying hosts performing OS fingerprinting on the network. Which traffic characteristic is MOST indicative of passive OS fingerprinting attempts?
- High ICMP echo request volume
- Capturing and analyzing TCP/IP stack behavior without sending probes (Correct answer)
- Sending crafted TCP packets with unusual flag combinations
- Large numbers of UDP packets to closed ports
Correct answer: Capturing and analyzing TCP/IP stack behavior without sending probes
Passive OS fingerprinting observes existing traffic characteristics (TTL, window size, TCP options) without sending any probes, making it nearly invisible.
CySA+ Test Network Monitoring 3
During network monitoring, an analyst identifies TCP sessions with the SYN flag set but no corresponding SYN-ACK responses from the destination.
What does this pattern MOST likely indicate?