CySA+ Test Network Monitoring 3

Question 1

During network monitoring, an analyst identifies TCP sessions with the SYN flag set but no corresponding SYN-ACK responses from the destination. What does this pattern MOST likely indicate?

Accepted Answer

SYN scan (half-open scan) reconnaissance

Answer

A SYN scan sends SYN packets but never completes the handshake; unanswered SYNs are characteristic of port scanning with half-open connections.

Question 2

Which SIEM use case BEST helps detect beaconing behavior from malware C2 communications?

Accepted Answer

Correlate periodic outbound connections to the same external IP at regular intervals

Answer

Malware beaconing is characterized by regular, periodic outbound connections to a C2 server, which correlation rules can identify by timing patterns.

Question 3

An analyst reviewing HTTPS traffic notices sessions with self-signed certificates issued by an unusual CA for a well-known financial site. What should the analyst suspect?

Accepted Answer

SSL inspection proxy or man-in-the-middle attack

Answer

A self-signed or unusual CA certificate for a known site often indicates an SSL inspection proxy or an active MITM attack intercepting the connection.

Question 4

What does a high ratio of DNS TXT record queries to A/AAAA record queries from a single host MOST suggest?

Accepted Answer

DNS tunneling for C2 or exfiltration

Answer

DNS tunneling tools frequently use TXT records to encode large payloads, so an unusually high TXT-to-A query ratio from one host warrants investigation.

Question 5

A network sensor captures traffic showing an internal host sending ARP replies claiming to be the default gateway, though it is not. Which attack does this indicate?

Accepted Answer

ARP poisoning / cache poisoning

Answer

Sending unsolicited ARP replies that falsely associate the attacker's MAC with the gateway IP is the defining behavior of ARP poisoning.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Network Monitoring 3