CySA+ Test Network Monitoring 2

Question 1

A security analyst notices a spike in ICMP echo requests from a single internal host to hundreds of external IPs within 60 seconds. What is the MOST likely explanation?

Accepted Answer

ICMP flood DDoS participation

Answer

Network discovery scan

Answer

Ping sweep reconnaissance

Answer

Routing table corruption

Question 2

Which NetFlow field is MOST useful for identifying lateral movement between internal hosts?

Accepted Answer

Source and destination IP pairs with byte counts

Answer

Source and destination AS numbers

Answer

TCP window size

Answer

DSCP markings

Question 3

An analyst sees repeated DNS queries for the same non-existent domain with slight character variations. Which attack technique does this BEST describe?

Accepted Answer

Domain generation algorithm (DGA) malware

Answer

DNS amplification

Answer

DNS cache poisoning

Answer

DNS zone transfer abuse

Question 4

A SIEM correlation rule fires when more than 10 failed logins occur for one account within 5 minutes. An analyst reviews alerts and finds 9 failed logins followed by success. What should the analyst do FIRST?

Accepted Answer

Investigate the successful login for signs of compromise

Answer

Close the alert as below threshold

Answer

Tune the rule threshold to 8

Answer

Block the source IP immediately

Question 5

Which protocol should be monitored to detect exfiltration via seemingly legitimate traffic using long TTL responses to encode data?

Accepted Answer

DNS

Answer

HTTPS

Answer

SMTP

Answer

SNMP

Question 6

An organization uses full packet capture (PCAP). When analyzing a suspected data exfiltration event, what is the PRIMARY advantage of PCAP over NetFlow?

Accepted Answer

Ability to inspect payload content

Answer

Lower storage requirements

Answer

Faster alerting

Answer

Better support for encrypted traffic

Question 7

A baseline shows an internal server generates 500 MB of outbound traffic daily. Monitoring shows 4.8 GB outbound on a Saturday. Which network monitoring concept does reviewing this represent?

Accepted Answer

Anomaly-based detection

Answer

Signature-based detection

Answer

Protocol analysis

Answer

Heuristic scanning