I85PREP
⌘ K
eCDFP study materials
eCDFP study resources

eCDFP practice questions

One question at a time. Build your eCDFP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Defensive Security Fundamentals

In the eCDFP defensive workflow, what is the primary purpose of endpoint detection and response (EDR) telemetry compared with traditional antivirus logs?

  1. It records continuous behavioral events such as process creation and network connections, enabling retrospective investigation Correct answer.
  2. It captures full packet payloads from the network segment for deep inspection
  3. It replaces the need for centralized logging by keeping all data on the host
  4. It stores only signature-match alerts so analysts can confirm known malware families

Explanation

EDR focuses on continuous behavioral telemetry (process, file, network, registry activity) that supports hunting and retrospective analysis rather than only signature alerts. This richer event stream is what lets defenders reconstruct an intrusion timeline after the fact.

Question 2Defensive Security Fundamentals

An analyst wants to determine which user account launched a suspicious process on a Windows host. Which artifact most directly answers this from standard endpoint telemetry?

  1. The host's ARP cache entries
  2. The process creation event containing the user context field Correct answer.
  3. The system's page file size
  4. The DNS resolver cache

Explanation

Process creation events typically include the account context (user name, SID, integrity level) alongside the image path and command line. That field directly ties the execution to a specific identity.

Question 3Defensive Security Fundamentals

Which statement best describes the role of a SIEM in a defensive security program?

  1. It aggregates and correlates logs from many sources to generate actionable detections Correct answer.
  2. It provides the antivirus signature database to endpoints
  3. It enforces file integrity by encrypting endpoint disks
  4. It performs static analysis of malware binaries before execution

Explanation

A SIEM centralizes log collection, normalization, and correlation so that events across hosts and network devices can be turned into alerts. Encryption, sandboxing, and signature distribution are separate functions handled by other tools.

Question 4Defensive Security Fundamentals

What does the MITRE ATT&CK framework primarily organize?

  1. Adversary tactics and techniques observed in real intrusions Correct answer.
  2. Regulatory compliance controls mapped to audit clauses
  3. Network protocol specifications and port assignments
  4. Software vulnerabilities ranked by CVSS score

Explanation

ATT&CK is a knowledge base of adversary tactics and techniques derived from observed behavior, used to structure detection coverage and threat hunting. It is not a vulnerability scoring system or a compliance mapping.

Question 5Defensive Security Fundamentals

In the pyramid of pain, which indicator type is most costly for an adversary to change?

  1. Tactics, techniques, and procedures Correct answer.
  2. IP addresses
  3. Domain names
  4. File hashes

Explanation

The pyramid of pain ranks TTPs at the top because changing established behaviors forces adversaries to retrain and redesign operations. Hashes, domains, and IPs sit near the bottom because they are trivially rotated.

Question 6Defensive Security Fundamentals

A defender wants to reduce alert fatigue from a noisy detection rule. Which approach best reflects sound detection engineering practice?

  1. Forward the alerts to a shared inbox without enrichment
  2. Increase the severity rating so analysts prioritize it
  3. Disable the rule permanently to eliminate the noise
  4. Add contextual conditions and tune thresholds based on observed false positives Correct answer.

Explanation

Detection tuning refines logic with additional context and thresholds so the rule fires on genuinely suspicious behavior while preserving coverage. Disabling or escalating noise does not improve signal quality.

Question 7Defensive Security Fundamentals

During triage, an analyst sees a PowerShell process spawned by a Microsoft Word process with an encoded command argument. What is the most defensible interpretation?

  1. A likely malicious macro execution that warrants immediate investigation Correct answer.
  2. A normal user logon event
  3. A routine Windows update mechanism
  4. A benign printer driver installation

Explanation

Office applications spawning PowerShell with encoded commands is a well-known pattern for macro-based execution and should be treated as high suspicion. Legitimate update and driver mechanisms do not typically chain Word to encoded PowerShell.

Question 8Defensive Security Fundamentals

Why is time synchronization across endpoints and log sources critical for incident investigation?

  1. It guarantees that log records cannot be tampered with
  2. It encrypts log traffic between agents and the collector
  3. It prevents attackers from using stolen credentials
  4. Accurate timestamps allow events from different sources to be correlated into a coherent timeline Correct answer.

Explanation

Investigations depend on ordering events across hosts, so clocks must agree within a known tolerance to build a reliable timeline. Synchronization does not provide authentication, encryption, or tamper-proofing.

Question 9Defensive Security Fundamentals

Which logging source would best help an analyst detect lateral movement using remote service creation on a Windows network?

  1. Security event logs recording service installation and logon type 3 activity Correct answer.
  2. The browser history of the affected user
  3. The print spooler queue
  4. The DHCP lease table for the subnet

Explanation

Remote service creation leaves service installation events and network logon (type 3) records in the Security log, which together indicate lateral movement. Browser history, DHCP leases, and print queues do not capture that behavior.

Question 10Defensive Security Fundamentals

What is the main defensive benefit of collecting DNS query logs from endpoints?

  1. They provide full payload contents of encrypted sessions
  2. They reveal attempted connections to malicious or newly registered domains Correct answer.
  3. They store file hashes for integrity monitoring
  4. They authenticate users to internal applications

Explanation

DNS logs expose the names hosts try to resolve, which can surface command-and-control or phishing domains even when traffic is encrypted. They do not decrypt sessions, authenticate users, or store file hashes.

Question 11Defensive Security Fundamentals

An analyst must preserve volatile evidence on a running Linux host during an active incident. Which action is most appropriate first?

  1. Delete suspicious files to prevent reinfection
  2. Immediately power off the machine to stop the attacker
  3. Capture memory and running process state before shutting the system down Correct answer.
  4. Reimage the host to restore a clean state

Explanation

Volatile data such as memory, network connections, and running processes is lost on shutdown, so it should be captured first when safe to do so. Powering off, reimaging, or deleting files destroys evidence needed for root-cause analysis.

Question 12Defensive Security Fundamentals

Which practice best supports evidence integrity when handing off collected disk images between analysts?

  1. Renaming the image file to match the case number only
  2. Compressing the image without documenting the tool used
  3. Storing the image on a shared drive with open write access
  4. Recording and verifying cryptographic hashes of the image at each transfer Correct answer.

Explanation

Hash values computed at acquisition and re-verified at handoff demonstrate that the image has not changed, supporting chain of custody. Open write access, undocumented tooling, and renaming alone do not establish integrity.

Question 13Defensive Security Fundamentals

What does a hash-based file reputation lookup tell a defender about an unknown binary?

  1. Which user account executed the file most recently
  2. Whether the file will execute successfully on the host
  3. Whether that exact file content has been previously observed and classified Correct answer.
  4. Whether the binary contains obfuscated code sections

Explanation

Hash reputation matches exact file content against known-good or known-bad databases, so it identifies previously seen samples only. It says nothing about internal structure, execution history, or runtime behavior.

Question 14Defensive Security Fundamentals

A detection rule alerts whenever a user logs in from a new country. Which weakness most limits the value of this rule as written?

  1. It only works on Linux endpoints
  2. It lacks baselining for legitimate travel and VPN egress, producing many false positives Correct answer.
  3. It cannot access authentication logs at all
  4. It requires full packet capture to function

Explanation

Geographic anomaly rules are noisy without context about travel, VPN egress, and cloud proxies, so baselining and enrichment are needed. The rule itself does not depend on packet capture or a specific operating system.

Question 15Defensive Security Fundamentals

Which combination best characterizes a defensible hypothesis-driven threat hunt?

  1. A testable attacker behavior hypothesis, scoped data sources, and documented queries with outcomes Correct answer.
  2. Running every available detection rule and closing all alerts
  3. Waiting for the SIEM to escalate a critical alert
  4. Scanning the network for open ports without a stated objective

Explanation

Hunts start from a specific, testable hypothesis about adversary behavior and use scoped telemetry and documented queries to confirm or refute it. Running all rules, reacting to alerts, or scanning without purpose is not hypothesis-driven hunting.

Question 16Defensive Security Fundamentals

Why should detection content be version-controlled alongside documentation of its logic and known false positives?

  1. It guarantees the rule will never generate false positives
  2. It enables change tracking, peer review, and rollback when a rule regresses Correct answer.
  3. It automatically maps the rule to every ATT&CK technique
  4. It encrypts the rule logic so attackers cannot read it

Explanation

Version control provides an auditable history, supports review before deployment, and allows reverting a rule that causes regressions. It does not eliminate false positives, encrypt logic, or auto-map techniques.

Question 17Defensive Security Fundamentals

An analyst finds a scheduled task created minutes after a suspicious login, running an unsigned binary from a user temp directory. Which conclusion is best supported?

  1. The binary must be a legitimate installer because it is in a temp folder
  2. The task is benign because scheduled tasks are a normal Windows feature
  3. The activity is consistent with persistence established after initial access and should be investigated Correct answer.
  4. The login was certainly a helpdesk password reset

Explanation

Persistence via scheduled tasks executing unsigned binaries from temp directories shortly after an anomalous login matches common post-compromise behavior. The feature being legitimate does not make this particular configuration benign.

Question 18Defensive Security Fundamentals

Which control most directly limits an attacker's ability to use stolen credentials for lateral movement in a Windows environment?

  1. Enforcing least privilege and tiered administrative accounts Correct answer.
  2. Increasing password maximum length to 20 characters
  3. Enabling verbose audit logging on all domain controllers
  4. Deploying a second antivirus engine on servers

Explanation

Least privilege and account tiering reduce the blast radius of stolen credentials by limiting what any single account can reach. Longer passwords, extra logging, and additional antivirus do not remove the standing privileges attackers abuse.

Question 19Defensive Security Fundamentals

A security team observes an endpoint making periodic HTTPS connections to a rare domain at fixed 60-second intervals with small, uniform payload sizes. What does this pattern most suggest?

  1. A scheduled operating system update
  2. Automated command-and-control beaconing Correct answer.
  3. A backup job transferring large archives
  4. A user browsing news websites

Explanation

Regular intervals, small uniform payloads, and a rare destination are classic beaconing characteristics of implant check-in traffic. Human browsing, OS updates, and backups produce different timing and volume profiles.

Question 20Defensive Security Fundamentals

An analyst reviews a memory image and finds an executable region not backed by a file on disk containing a PE header. Which interpretation is most accurate?

  1. It proves the host has no malware present
  2. It confirms the process is a legitimate signed system binary
  3. It suggests injected code or a reflective loader and warrants deeper analysis Correct answer.
  4. It indicates the memory image was captured incorrectly

Explanation

Executable memory without a corresponding on-disk file, especially containing a PE header, is a strong indicator of process injection or reflective loading. Legitimate signed binaries are normally file-backed, and this finding does not indicate a capture error.

Question 21Defensive Security Fundamentals

Two alerts fire: one for a blocked exploit attempt against an internet-facing server, another for the same server initiating outbound connections to a known-bad IP. How should the analyst prioritize and interpret them?

  1. Close the outbound alert as a scanner artifact without review
  2. Escalate the blocked attempt only and ignore outbound traffic
  3. Treat the outbound connection as higher priority because it may indicate the block failed and compromise occurred Correct answer.
  4. Dismiss both because the exploit was blocked

Explanation

A blocked exploit plus subsequent outbound contact to known-bad infrastructure raises the possibility of successful compromise despite the block. Outbound command-and-control traffic is generally the more urgent signal and should drive triage.

Question 22Defensive Security Fundamentals

Which approach best detects living-off-the-land abuse that uses only signed system utilities?

  1. Behavioral analytics on command-line arguments and parent-child process relationships Correct answer.
  2. Blocking all outbound traffic from servers
  3. Signature scanning of binaries against known malware hashes
  4. Relying solely on file creation events in system directories

Explanation

Living-off-the-land techniques reuse signed binaries, so hash and signature checks will not flag them; behavior around arguments and process ancestry is what distinguishes abuse. Blanket blocking and narrow file-event monitoring miss the activity.

Question 23Defensive Security Fundamentals

Which statement correctly distinguishes a vulnerability scan from a penetration test in a defensive program?

  1. Both produce identical output and differ only in scheduling
  2. A penetration test is fully automated, while a scan requires manual exploitation
  3. A vulnerability scan exploits findings, while a penetration test only lists them
  4. A vulnerability scan enumerates known weaknesses, while a penetration test attempts goal-driven exploitation Correct answer.

Explanation

Vulnerability scanning identifies and reports known weaknesses, usually without exploitation, whereas penetration testing chains weaknesses toward defined objectives. The two differ in depth and intent, not merely in schedule.

Question 24Defensive Security Fundamentals

What is the defensive purpose of network segmentation in limiting ransomware spread?

  1. It encrypts all data at rest on file servers
  2. It replaces the need for endpoint detection agents
  3. It guarantees backups cannot be deleted
  4. It constrains lateral movement by restricting which hosts can reach each other Correct answer.

Explanation

Segmentation reduces the reachable attack surface so compromised hosts cannot freely contact other systems, slowing propagation. It does not encrypt data, replace endpoint controls, or protect backups by itself.

Question 25Defensive Security Fundamentals

An analyst wants to confirm whether a suspicious login succeeded or failed. Which log detail is most decisive?

  1. The timestamp of the attempt only
  2. The source IP geolocation only
  3. The hostname of the target server only
  4. The authentication event ID paired with its result status code Correct answer.

Explanation

Authentication logs record distinct event IDs and status codes for success versus failure, which is the decisive evidence. Source location, hostname, and timestamp add context but cannot alone confirm the outcome.

Question 26Defensive Security Fundamentals

In the Cyber Defense Analyst workflow, which activity belongs to the Detection and Analysis phase of the incident response lifecycle rather than to Preparation?

  1. Validating a suspicious authentication event against endpoint and identity telemetry Correct answer.
  2. Establishing logging coverage and retention baselines for critical servers
  3. Writing the incident response plan and obtaining executive sign-off
  4. Deploying endpoint agents and confirming they report to the console

Explanation

Preparation covers building capability before an incident: plans, tooling, logging coverage, and agent deployment. Detection and Analysis is where telemetry is triaged and validated to determine whether activity is malicious, so correlating an authentication event against multiple sources sits in that phase.

Question 27Defensive Security Fundamentals

A defender is choosing which telemetry to onboard first for a new detection program. Which principle best guides prioritization when coverage cannot be complete?

  1. Prioritize sources whose vendors offer the longest raw retention window
  2. Prioritize sources mapped to the adversary behaviors the organization most needs to detect Correct answer.
  3. Prioritize the sources that generate the highest volume of events per day
  4. Prioritize sources that require the fewest parsing changes in the pipeline

Explanation

Coverage decisions should be driven by the threats the organization actually needs to see, typically derived from a threat model or prioritized adversary behaviors. Volume, retention, and parsing effort are operational constraints, not reasons to select a source that answers no detection requirement.

Question 28Defensive Security Fundamentals

Which statement correctly describes the role of the CIA triad when defenders evaluate a proposed security control?

  1. It applies only to data at rest and not to data in transit or in use
  2. It guarantees that a control satisfying all three properties needs no further testing
  3. It ranks controls by their purchase cost relative to the risk reduction delivered
  4. It provides a lens for judging which security property a control protects and which it may weaken Correct answer.

Explanation

Confidentiality, integrity, and availability are properties used to reason about what a control protects and what trade-offs it introduces, such as encryption strengthening confidentiality while complicating availability during key loss. The triad is an analytical lens, not a cost model or a certification.

Question 29Defensive Security Fundamentals

What distinguishes a threat actor's capability from their intent when a defender builds a risk picture?

  1. Capability applies only to nation-state actors; intent applies only to criminals
  2. Capability describes resources and skill; intent describes motivation and targeting interest Correct answer.
  3. Capability describes motivation; intent describes the tools and infrastructure available
  4. Capability and intent are interchangeable terms for the same assessed attribute

Explanation

Capability is about what an adversary can do, such as tooling, funding, and skill, while intent is about whether they want to target you and why. Defensive prioritization needs both, because a highly capable actor with no interest in your sector is a different risk from a modest actor actively targeting it.

Question 30Defensive Security Fundamentals

An analyst is asked to explain why defense in depth still matters when a strong perimeter control is already in place. Which reasoning is most defensible?

  1. Perimeter controls are unnecessary once endpoint detection is deployed everywhere
  2. Any single control can fail or be bypassed, so independent layers limit the impact of one failure Correct answer.
  3. Layering controls mainly serves to satisfy auditors rather than to change attacker outcomes
  4. Defense in depth removes the need to monitor internal east-west traffic

Explanation

Defense in depth assumes that any individual control has failure modes, whether through misconfiguration, evasion, or a novel technique. Independent layers mean a single bypass does not grant full access, and they create additional opportunities for detection.

Question 31Defensive Security Fundamentals

A defender maps a detected technique to MITRE ATT&CK. What is the primary defensive value of that mapping?

  1. It assigns a numerical severity score that directly sets incident priority
  2. It certifies that the detected activity was malicious rather than benign
  3. It links observed behavior to known adversary goals and to candidate detection and mitigation coverage Correct answer.
  4. It replaces the need to collect endpoint telemetry for that technique

Explanation

ATT&CK organizes observed behavior into tactics and techniques, which helps defenders understand what the adversary is trying to achieve and where coverage gaps exist. It is a knowledge base for structuring analysis, not a verdict engine or a severity calculator.

Question 32Defensive Security Fundamentals

Which practice best reflects the principle of least privilege for a service account used by a backup application?

  1. Granting the account domain administrator rights so backups never fail on permissions
  2. Disabling logging for the account because its activity is known and trusted
  3. Sharing the account credentials with administrators to simplify troubleshooting
  4. Granting only the specific read and backup rights the application requires and monitoring its use Correct answer.

Explanation

Least privilege means granting only the access needed for the function, so a backup account should hold targeted backup and read rights rather than broad administrative power. Monitoring the account preserves the ability to notice misuse if credentials are stolen.

Question 33Defensive Security Fundamentals

An organization wants to reduce the chance that a compromised workstation can reach a database server directly. Which control addresses this most directly?

  1. Enforcing full-disk encryption on the database server volumes
  2. Increasing the password complexity policy for all domain users
  3. Segmenting the network and restricting workstation-to-database flows to approved paths Correct answer.
  4. Enabling verbose audit logging on the workstation operating system

Explanation

Segmentation with restrictive flow rules limits which hosts can reach the database, so a compromised workstation cannot connect directly. The other options improve confidentiality, credential strength, or visibility but do not change reachability.

Question 34Defensive Security Fundamentals

Which statement correctly distinguishes an indicator of compromise from an indicator of attack?

  1. IOCs and IOAs are synonyms and differ only in how they are formatted
  2. An IOC is behavioral and forward-looking; an IOA is a static artifact such as a file hash
  3. IOCs apply only to network traffic and IOAs apply only to host memory
  4. An IOC is a forensic artifact suggesting past compromise; an IOA describes behavior indicating an attack in progress Correct answer.

Explanation

Indicators of compromise are artifacts such as hashes, domains, or registry keys that suggest a compromise may have occurred. Indicators of attack focus on behavior and intent, which makes them more durable against minor attacker changes and more useful for detecting activity as it unfolds.

Question 35Defensive Security Fundamentals

An analyst needs to decide whether an alert about a rare parent-child process relationship is worth escalating. Which factor most strengthens the case for escalation?

  1. The parent process is a commonly installed office application on many endpoints
  2. The relationship is consistent with a known technique and the endpoint also shows new persistence Correct answer.
  3. The alert was generated outside business hours on a developer workstation
  4. The same relationship appears in the environment's approved software baseline

Explanation

Escalation is strongest when the behavior matches a known adversary technique and is corroborated by additional evidence such as newly created persistence. That combination raises confidence beyond a single isolated anomaly.

Question 36Defensive Security Fundamentals

What is the defensive purpose of maintaining an asset inventory that records business criticality alongside technical attributes?

  1. It eliminates the need for vulnerability scanning on inventoried systems
  2. It guarantees that every asset is patched within the defined SLA
  3. It allows analysts to prioritize response and detection coverage according to business impact Correct answer.
  4. It replaces configuration management databases with spreadsheets

Explanation

Knowing which systems support critical business functions lets defenders rank alerts, focus detection coverage, and sequence containment where impact is highest. Inventory is an input to prioritization, not a substitute for scanning, patching, or configuration management.

Question 37Defensive Security Fundamentals

A defender is documenting a detection's logic so another analyst can maintain it. Which element is most important to record alongside the rule itself?

  1. The approximate word count of the rule's documentation
  2. The name of the analyst who first proposed the rule
  3. The date the detection platform was originally procured
  4. The intended behavior being detected and the known benign triggers Correct answer.

Explanation

A maintainable detection records what behavior it targets and which benign activities are expected to trigger it, so future analysts can tune without rediscovering context. Authorship, document length, and procurement dates do not help someone judge whether the rule still works as intended.

Question 38Defensive Security Fundamentals

An analyst must explain why a detection based solely on a static file hash has limited long-term value. Which reasoning is correct?

  1. Hashes cannot be computed for files larger than a few megabytes
  2. Hash matching requires network traffic inspection and cannot run on endpoints
  3. Hashes change whenever the file is copied to a different filesystem
  4. Attackers can trivially alter the file so its hash changes while functionality is preserved Correct answer.

Explanation

A hash is a fingerprint of exact bytes, so any trivial modification, such as changing a resource or adding padding, produces a new hash and defeats the indicator. This is why behavioral detections tend to outlast hash-based ones.

Question 39Defensive Security Fundamentals

A team is deciding how to handle a detection that fires constantly on a legitimate administrative tool. Which response best balances detection value against analyst workload?

  1. Narrow the logic to the abusive context, add documented exceptions, and monitor the residual signal Correct answer.
  2. Remove the administrative tool from the environment to eliminate the alert source
  3. Disable the detection permanently and rely on user reports instead
  4. Raise the severity of every alert so analysts treat the tool as inherently malicious

Explanation

Refining logic to focus on the abusive context, while documenting exceptions, preserves coverage of misuse without drowning analysts in expected activity. Permanent disablement loses coverage, blanket severity inflation worsens fatigue, and removing a needed tool imposes business cost without addressing detection design.

Question 40Defensive Security Fundamentals

A defender is assessing whether an observed sequence of activity represents a coherent intrusion rather than unrelated events. Which analytical approach is most sound?

  1. Treat each alert independently and escalate only those with the highest individual severity
  2. Chain events by host, identity, and time to test whether they form a plausible adversary progression Correct answer.
  3. Discard low-severity alerts because they cannot be part of a serious intrusion
  4. Assume any activity on a critical server is malicious regardless of context

Explanation

Intrusions often appear as a sequence of individually unremarkable events that only become meaningful when correlated across host, identity, and time. Testing whether the chain matches a plausible progression distinguishes a coherent intrusion from coincidental noise.

Question 41Network Defense and Traffic Analysis

During traffic analysis, an analyst observes a TCP three-way handshake followed by a client sending an ACK with no corresponding SYN. Which statement best describes what this ACK likely represents?

  1. A scan probing for open ports on the server
  2. A reset initiated by the server
  3. A retransmission of a lost SYN packet
  4. The final step completing an established connection Correct answer.

Explanation

The three-way handshake consists of SYN, SYN-ACK, and a final ACK from the client, after which the connection is established. An ACK following the SYN-ACK completes connection setup rather than indicating an attack.

Question 42Network Defense and Traffic Analysis

An IDS rule triggers when a single packet contains both the SYN and FIN flags set simultaneously. What is the most accurate interpretation of this traffic?

  1. Encrypted application data in transit
  2. A malformed or crafted packet often used for evasion or reconnaissance Correct answer.
  3. A normal retransmission of a completed handshake
  4. A legitimate connection teardown sequence

Explanation

Setting SYN and FIN together is an invalid flag combination that no normal TCP stack produces. Such packets are typically crafted to probe firewall or IDS behavior and evade naive filtering.

Question 43Network Defense and Traffic Analysis

A packet capture shows repeated DNS queries to a single domain with subdomains of increasing length and high entropy, sent at regular intervals. Which threat is most consistent with this pattern?

  1. A zone transfer request
  2. DNS tunneling for data exfiltration Correct answer.
  3. DNS cache poisoning against a resolver
  4. Normal load-balanced resolution

Explanation

High-entropy, variable-length subdomains sent at a steady cadence are a hallmark of DNS tunneling, where data is encoded into query names. Cache poisoning and zone transfers produce different observable patterns.

Question 44Network Defense and Traffic Analysis

Which HTTP header field is most useful for identifying the client software and version behind a web request during traffic analysis?

  1. Host
  2. Content-Length
  3. User-Agent Correct answer.
  4. Accept-Encoding

Explanation

The User-Agent header advertises the client application and version, making it valuable for fingerprinting browsers or tools. The other headers describe the target host, body size, or encoding preferences rather than client identity.

Question 45Network Defense and Traffic Analysis

An analyst sees a TLS ClientHello with a legacy protocol version and a cipher suite list containing only weak export-grade ciphers. What does this most strongly suggest?

  1. A completed TLS session with forward secrecy
  2. A modern browser negotiating normally
  3. A client attempting to downgrade to weak encryption Correct answer.
  4. A server certificate validation failure

Explanation

Offering only weak export ciphers and old versions indicates an attempt to force a downgrade to breakable encryption. A healthy modern client advertises current versions and strong cipher suites.

Question 46Network Defense and Traffic Analysis

Which TCP flag combination is characteristic of an Xmas tree scan?

  1. SYN only
  2. FIN, PSH, and URG set together Correct answer.
  3. ACK and RST set together
  4. SYN and ACK set together

Explanation

An Xmas tree scan sets FIN, PSH, and URG simultaneously, an invalid combination meant to elicit varied responses from different stacks. This abnormal flag set helps map firewall and OS behavior.

Question 47Network Defense and Traffic Analysis

A capture shows many outbound connections to a single external IP on port 443, each transferring a similar small volume of data at fixed intervals. Which analysis approach best distinguishes command-and-control beaconing from normal browsing?

  1. Reviewing the local ARP cache
  2. Counting the number of DNS servers contacted
  3. Checking whether the destination uses HTTPS
  4. Measuring the jitter and periodicity of connection timing Correct answer.

Explanation

Beaconing exhibits regular, low-jitter timing that differs from human browsing patterns. Analyzing interval consistency and jitter is the most direct way to separate automated callbacks from normal traffic.

Question 48Network Defense and Traffic Analysis

Which protocol uses a three-way handshake and provides reliable, ordered delivery of segments?

  1. TCP Correct answer.
  2. UDP
  3. ICMP
  4. ARP

Explanation

TCP establishes connections with a handshake and guarantees ordered, reliable delivery through sequence numbers and acknowledgments. UDP is connectionless and unreliable, while ICMP and ARP serve different purposes.

Question 49Network Defense and Traffic Analysis

A network sensor reports a large volume of SYN packets from many spoofed source addresses to a single destination, with no completed handshakes. What type of attack does this indicate?

  1. SYN flood denial of service Correct answer.
  2. Slowloris application-layer exhaustion
  3. DNS amplification
  4. Session hijacking

Explanation

A SYN flood sends many half-open connection requests with spoofed sources, exhausting the server's backlog without completing handshakes. The absence of completed handshakes is the key distinguishing signal.

Question 50Network Defense and Traffic Analysis

When analyzing NetFlow records, which field pair is most useful for identifying a long-lived connection between an internal host and an external server?

  1. Source port and TTL
  2. Start time and duration Correct answer.
  3. Packet length and checksum
  4. MAC address and VLAN

Explanation

Flow records include session start time and duration, allowing analysts to identify unusually long-lived connections. Port and TTL fields describe individual packets rather than session longevity.