Deck 2: Analyzing Network Reconnaissance

Question 1

A threat actor has gone to a local coffee shop and opened a program that can analyze traffic being sent and received on the network. He finds that someone on the network is sending emails using SMTP without encryption, and he can see the contents of the emails. Which of the following programs is he most likely using?

A) netstat
B) dig
C) Wireshark
D) Nessus

Answer 1

Wireshark

Question 2

Umberto works for an organization that has created a policy prohibiting the use of open source software unless there is no alternative. He wants to sniff packets on the network, but most of the sniffer applications are open source. Which of the following software packages would adhere to the company's policy?

A) Wireshark
B) EtherApe
C) NetworkMiner
D) Network General

Answer 2

Network General

Question 3

A cybersecurity analyst is researching syslog for possible implementation at his organization. He is reading about the elements that syslog messages contain and sees the priority and header fields. Which of the following fields contains the contents of the messages?

A) MSG
B) CONTENT
C) VALUE
D) STAT

Answer 3

MSG

Question 4

Ian, a cybersecurity analyst, wants to use a system to identify when employees are using Telnet on the network by examining only the headers of packets as they traverse the network. Which of the following might he decide to implement to meet this goal?

A) Packet analysis
B) Protocol analysis
C) Traffic analysis
D) Wireless analysis

Question 5

Morena wants to use Wireshark to analyze the types of traffic being sent across her company's network. Which of the following types of analysis does she want to perform?

A) Wireless analysis
B) Traffic analysis
C) Packet analysis
D) Protocol analysis

Question 6

Talera believes an evil twin might be planted somewhere around her company's office. Which of the following is the best method of finding where it might be located?

A) Protocol analysis
B) Traffic analysis
C) Packet analysis
D) Wireless analysis

Question 7

Jorge is analyzing the event logs on a server and sees that someone attempted to log into a user account twice with the incorrect password before logging in successfully. In which of the following general types of logs were these events most likely captured?

A) System
B) Security
C) Application
D) Authentication

Question 8

Tina wants to determine the fault toleranceof the servers in her data center, and is reviewing the previous 24 months of logs using an analysis tool. Which of the following types of analysis is Tina most likely performing?

A) Conditional analysis
B) Anomaly analysis
C) Behavioral analysis
D) Availability analysis

Question 9

Thierry wants to implement a method of analyzing network traffic to detect attacks by using a database of known attacks for comparison. Which of the following methods of analysis meets his goal?

A) Signature analysis
B) Behavioral analysis
C) Availability analysis
D) Anomaly analysis

Question 10

Jonquil, a cybersecurityanalyst, has been asked to implement a system that collects information for analysis about traffic flowing through the routers and switches on her company's network. Which of the following protocols should she considerto implement this type of setup?

A) IDS
B) Resource Monitor
C) NetFlow
D) SIEM

Question 11

Neo wants to consolidate real-time monitoring and management of security-related information with analysis and reporting of events. Which of the following might he want to implement?

A) IGRP
B) SERP
C) SIEM
D) IMEI

Question 12

Nichole, a cybersecurity analyst, has received an alert about a potential ping flood on one of the company's Windows servers. She is able to connect to the server via an out-of-band management network. Which of the following native tools might help her verify what is occurring on the server at the moment?

A) Resource Monitor
B) tcpdump
C) Wireshark
D) Network General

Question 13

Cyndi, a cybersecurity researcher, has been hired to comb through historical data at a large organization after an APT was discovered. She needs to determine the extent of the attack and be able to view various parts of the network's logs to give her the full context of what occurred. Which of the following might best describe the type of analysis she is performing?

A) Packet analysis
B) Retrospective network analysis
C) Signature analysis
D) Anomaly analysis

Question 14

Match the command switch used with nmap to generate on of the output types

-Interactive

A) (Default)
B) -oN
C) -oX
D) -oG

Question 15

Match the command switch used with nmap to generate on of the output types

-Interactive output stored in a file

A) (Default)
B) -oN
C) -oX
D) -oG

Question 16

Match the command switch used with nmap to generate on of the output types

-Output in Extensible Markup Language

A) (Default)
B) -oN
C) -oX
D) -oG

Question 17

Match the command switch used with nmap to generate on of the output types

-Output that can be manipulated using Linux command-line tools

A) (Default)
B) -oN
C) -oX
D) -oG