MENU
Refer to exhibit.
An engineer is Investigating an Intrusion and Is analyzing the pcap file. Which two key elements must an engineer consider? (Choose two.)
Suggested Answer: B, D
Get Premium 200-201 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The exhibit shows a pcap file capturing multiple TCP SYN packets directed at the same destination IP address.
High volume of SYN packets with very little variance in time: This pattern is indicative of a SYN flood attack, a type of Denial of Service (DoS) attack where numerous SYN requests are sent to overwhelm the target system.
SYN packets acknowledged from several source IP addresses: This can be indicative of a Distributed Denial of Service (DDoS) attack where multiple compromised hosts (botnet) are used to generate traffic.
These characteristics suggest that the network is under a SYN flood or DDoS attack, aiming to exhaust the target's resources and disrupt service availability.
Understanding SYN Flood Attacks
Analysis of DDoS Attack Patterns
Wireshark Analysis Techniques for Intrusion Detection
31 comments · newest first
KR
Krystina
11 months ago
Not sure about C, identical lengths can be misleading sometimes.
VA
Val
11 months ago
Agreed, B and D really stand out in intrusion analysis.
LY
Lynelle
11 months ago
Surprised that E is even an option, seems too basic!
DE
Deeanna
11 months ago
I think A and C are more relevant here.
GL
Glenn
12 months ago
Definitely B and D, those are key indicators.
AB
Abraham
12 months ago
I’m leaning towards the SYN packets from multiple IPs being a key indicator of an intrusion, but I’m not confident about the other option.
JO
Jolene
1 year ago
I definitely recall that identical lengths and window sizes can indicate something unusual, but I’m unsure if that’s the best choice here.
KA
Kanisha
1 year ago
I think we practiced a question similar to this where we had to identify patterns in packet captures. I feel like the sequence number could be relevant, but I can't recall why exactly.
GA
Gail
1 year ago
I remember discussing the importance of SYN packets in class, but I'm not sure if it's just the volume or the variance that matters.
LA
Lauryn
1 year ago
This is a tough one. I'm a bit confused about which two elements I should focus on. Guess I'll have to read through the options carefully and try to eliminate the less relevant ones.
DO
Douglass
1 year ago
Ah, I see. The question is asking about specific indicators of an intrusion, like the sequence numbers and packet timing. I think I've got a good strategy to approach this.
DE
Derick
1 year ago
Okay, let's see. The key elements seem to be related to the TCP session characteristics. I'll need to examine the SYN packets and look for any unusual behavior.
PA
Pamella
1 year ago
Hmm, the question is a bit tricky. I'm not sure if I should be looking at the packet headers, payload, or both. Gotta think this through carefully.
BL
Blair
1 year ago
This looks like a classic network intrusion scenario. I'd focus on analyzing the packet capture for any suspicious patterns or anomalies.
DO
Dominque
2 years ago
Hold up, 'same source IP with port 80'? That's a classic web server attack, no doubt. E is the way to go!
JU
Judy
2 years ago
Wait, is the 'info' field really that important here? I dunno, I'm going with A just to be safe.
SL
Slyvia
2 years ago
I think 'info' field is important, but D seems crucial too.
LU
Lucina
2 years ago
D) SYN packets acknowledged from several source IP addresses
JU
Justine
2 years ago
A) Variable 'info' field and unchanging sequence number
CH
Cherry
2 years ago
I believe another important element to consider is the high volume of SYN packets with very little variance in time.
CA
Carla
2 years ago
Intrusion analysis? More like 'Infusion' analysis, am I right? *wink wink*
MI
Misty
2 years ago
B) High volume of SYN packets with very little variance in time
AR
Arminda
2 years ago
A) Variable 'info' field and unchanging sequence number
XO
Xochitl
2 years ago
Whoa, these options are like a buffet of cybersecurity goodness! I'm getting hungry just thinking about it.
LI
Lizbeth
2 years ago
B) High volume of SYN packets with very little variance in time
BO
Bobbye
2 years ago
A) Variable 'info' field and unchanging sequence number
DE
Denise
2 years ago
I agree with Shenika. Those two elements can provide valuable information in analyzing the pcap file.
SH
Shenika
2 years ago
I think the key elements to consider are the variable 'info' field and unchanging sequence number.
KR
Kristin
2 years ago
The 'identical length' and 'window size' clues definitely stand out to me. Gotta be option C!
CA
Carey
2 years ago
I think we should also look at option D, SYN packets acknowledged from several source IP addresses.
CA
Carrol
2 years ago
I agree, option C seems like a key element to consider.