Chapter 2: Analyzing the Results of Reconnaissance Flashcards
Which of the following data sources would offer the least diverse, most precise kind
of information?
A. Syslogs
B. Firewalls logs
C. Packet captures
D. Nmap results
D is correct. Nmap results are particularly focused as port scans and only contain the
information asked for, depending on the command-line switches the operator uses.
A, B, and C are incorrect. A is incorrect because syslogs can include a very wide variety of events, such as an application faulting, a security event, or something pertaining to the system itself. B is incorrect because firewall logs are also more diverse than nmap results. Although only related to traffic-related events, the logs are quite a diverse mix. C is incorrect because the traffic seen on any network can be wide ranging.
What device combines the functionality of a traditional firewall and an IPS? A. Next-Generation Firewall B. DSN firewall C. Enterprise firewall D. Discovery firewall
A is correct. Next-Generation Firewall combines a traditional firewall with intrusion
detection and prevention.
B, C, and D are incorrect. There are no such devices as a DSN firewall, enterprise firewall, and discovery firewall.
Which of the following are the two types of approaches to analyzing data? A. Compare and contrast B. Correlation C. Patterned D. Point-in-time
B and D are correct. Point-in-time analysis describes examining data around a snapshot in time, whereas correlation analysis focuses on anomalies or changes over time, whether you’re searching for abnormal behavior, some outlier, or a trend.
A and C are incorrect. A is incorrect because “compare and contrast” is not the term coined for such analysis. Although you could say it describes one type of analysis,
it wouldn’t include all aspects of correlation analysis. C is incorrect for similar reasons. “Patterned” analysis is not the term used to describe a standard approach for analyzing data.
In an IP packet header, what field value is decremented with each interface the packet goes through? A. Fragment offset B. ToS C. TTL D. IHL
C is correct. TTL stands for Time To Live, the value set for how many hops a packet has to go through before ending and expiring. The starting value for TTL varies based on operating system, but the more popular OSs use a value of either 255
or 128.
A, B, and D are incorrect. A is incorrect because the fragment offset facilitates breaking up a packet into smaller, individually transmitted units. B is incorrect because the Type of Service field helps set a priority for or quality to the packet.
D is incorrect because the Internet Header Length value just denotes the length of the header.
Which of the following is an example of point-in-time analysis? A. Anomaly analysis B. Behavioral analysis C. Availability analysis D. Traffic analysis
D is correct. Traffic analysis is an example of point-in-time analysis.
A, B, and C are incorrect. These are all forms of correlation analysis.
Recently, a few users have been complaining that their workstations are exhibiting some strange behavior. However, you find no obvious events showing up in system logs, and the application logs show nothing out of the ordinary. You suspect the issue could be new malware and decide to delve deeper.
You inspect logs from multiple sources. Your hope is to find some odd behavior. What type of analysis are you performing now? A. Trend B. Heuristics C. Packet capture D. Spatial trend
B is correct. The scenario portrays a new, unknown behavior. From that, you know
you cannot rely on known threats. This will require heuristics analysis.
A, C, and D are incorrect. A is incorrect because careful trend analysis might only show effects of the malware, but won’t disclose the malware itself. C is incorrect because packet capture analysis is helpful after you know what you’re looking for, but searching for anomalies in a packet capture is looking for the proverbial “needle in a haystack.” D is incorrect because spatial trend analysis deals with correlating between different geographical areas.
Recently, a few users have been complaining that their workstations are exhibiting some strange behavior. However, you find no obvious events showing up in system logs, and the application logs show nothing out of the ordinary. You suspect the issue could be new malware and decide to delve deeper.
Based on your assumptions, how will you likely discover the malware?
A. The packet trace will reveal a port famous for malware.
B. The IDS log will show a matched signature.
C. Your experience will guide your analysis.
D. The long-term degradation in availability.
C is correct. Heuristic analysis can’t rely on a signature or known behavior. Instead,
experience best guides your analysis.
A, B, and D are incorrect. A and B are incorrect because the answer suggests a known signature (famous malware port or an IDS signature). D is incorrect because although trend analysis might possibly point out symptomatic differences, it will not discover and identify the malware.
Recently, a few users have been complaining that their workstations are exhibiting some strange behavior. However, you find no obvious events showing up in system logs, and the application logs show nothing out of the ordinary. You suspect the issue could be new malware and decide to delve deeper.
Select the most valuable data sources in this analysis. (Choose two.) A. IDS/IPS B. Router logs C. Security logs of affected servers D. Next-Generation Firewall
A and D are correct. The intrusion detection/prevention system very likely logged information relevant for your analysis. Similarly, the firewall might show if or when malicious traffic passed through to the affected systems.
B and C are incorrect. The router log is unlikely to reveal any information specific to the suspected malware. The security logs of affected systems might yield valuable information. However, if the system is compromised, you cannot trust its logs as complete or accurate.
Recently, a few users have been complaining that their workstations are exhibiting some strange behavior. However, you find no obvious events showing up in system logs, and the application logs show nothing out of the ordinary. You suspect the issue could be new malware and decide to delve deeper.
Which of the following would be the most valued SIEM tool in this scenario? A. Bro
B. Snort
C. Splunk
D. ELK
A is correct. Bro is both signature- and anomaly-based. Bro will watch sessions, monitoring for strange behavior. Bro is also able to extract executables from network traffic, retaining them for forensic analysis.
B, C, and D are incorrect. B is incorrect because Snort as an IDS would be signature- based, and as such not likely to catch the new malware. C is incorrect because although Splunk is incredible as a SIEM, it wouldn’t necessarily be the tool able to discover and identify new malware. D is incorrect because ELK is a package of three open source tools (Elasticsearch, Logstash, and Kibana), which together operate similarly to the commercial product Splunk.
Your company has used Splunk over many years, during a large growth in infrastructure. Lately, network engineers are complaining that Splunk requires a significant share of the network bandwidth. What might be the best course of action to resolve the network issue?
A. Eliminate the “noisy” SIEM.
B. Make use of heavy forwarders to index data at the source.
C. Have the network engineer run a separate path for the Splunk data.
D. Make the indexers fault tolerant.
B is correct. Splunk normally sends raw data onto the universal forwarder to be indexed. Using heavy forwarders instead at each source can accomplish preprocessing, before the event data is forwarded.
A, C, and D are incorrect. A is incorrect because eliminating the SIEM causes much more harm to the company’s ability to monitor security information. C is incorrect because running a separate network path is far more work than necessary. D is incorrect because fault tolerance is not a solution to the problem of heavy network usage.
Given an IP address, a security analyst seeks to identify and locate a system. Comparing Figures 2-1 and 2-2, select the most relevant difference between the two scans.
A. The system represented in Figure 2-1 has several unknown services listening on dynamic ports.
B. The system represented in Figure 2-2 is behind a firewall.
C. The system represented in Figure 2-1 is behind a firewall.
D. The scan shown in Figure 2-1 positively identifies the OS.
C is correct. Figure 2-1 shows a system that’s likely behind a firewall. This is determined by noticing that the ports are reported as “filtered,” as compared to “closed” in Figure 2-2.
A, B, and D are incorrect. A is incorrect because the additional ports reported
in the dynamic range (49152 to 65535) are likely not services that are listening.
B is incorrect because Figure 2-2 reports closed ports. If the system were behind a firewall, the ports would be reported as filtered. D is incorrect because neither scan conclusively identifies the operating system.
Which of the following is not a valid Event Log category in Windows desktop systems? A. Application B. System C. Security D. Storage E. Audit
D is correct. Storage is not an actual Event Log category.
A, B, C, and E are incorrect. All of these answers—Application, System, Security, and
Audit—are valid Event Log categories.
You are viewing the Event Log and you list the warnings from a Windows 10 machine. Referring to Figure 2-3, select the log category from which the warning came, as well as the Event ID and the machine name. A. Security, 1014, DNS Client B. Security, 1014, XERXES C. System, 268435456, XERXES D. System, 1014, XERXES
D is correct. The log name is shown as System, with an event ID of 1014. Also, the
system name is shown as COMPUTER: XERXES.
A, B, and C are incorrect. A and B are incorrect because of they have the wrong log category. Additionally, A has an incorrect system name. C is incorrect because it shows a numeric string from Keywords, which is not the same as the event ID (1014).
An analyst has launched nmap to scan an unknown machine. From the ports shown in Figure 2-4, what can the analyst assume is the operating system? A. Linux B. Windows C. Ubuntu D. OpenVMS E. Cisco IOS
B is correct. The scanned system is Windows. The revealing evidence is the
discovered TCP ports 135 and 139.
A, C, D, and E are incorrect. Those operating systems would not show TCP ports 135 and 139 as open.
A cybersecurity analyst scans the network for servers with TCP port 636 open. What other port can the analyst expect to find open on each of those servers? A. 22 B. 111 C. 53 D. 389 E. 5000
D is correct. Port 636 is open for LDAP over SSL (LDAPS). Any server that has port 636 listening very likely also has LDAP listening on port 389.
A, B, C, and E are incorrect. A is incorrect because port 22 is typically for SSH. B is incorrect because port 111 is for MSRPC (Microsoft Remote Procedure Call). C is incorrect because port 53 is for DNS. Lastly, E is incorrect because port 5000 could be for several services, but nothing specifically associated with port 636.
