41. What zero trust really means
Which design best reflects zero trust architecture (as described in NIST SP 800-207)?
- A.A strong perimeter firewall, with full trust given to anything inside the corporate network
- B.A VPN that gives remote users the same flat network access as office users
- C.Each access request is authenticated and authorised using identity, device health and context, with least privilege and no implicit trust from network location
- D.Blocking all internet access for employees
Show answer
Answer: C. Each access request is authenticated and authorised using identity, device health and context, with least privilege and no implicit trust from network location
Zero trust removes implicit trust based on network location. Every request to a resource is checked using identity (with strong MFA), device posture and context, and access is granted with least privilege and re-evaluated continuously. A flat VPN or trusted internal network is exactly the model zero trust replaces, because one compromised device can then move laterally.
42. DNS logs went quiet
After a browser update, DNS query volume in your resolver logs dropped sharply for many laptops, but web traffic stayed the same. What is the most likely cause and response?
- A.The laptops are offline; open a network outage ticket
- B.Attackers deleted the resolver logs
- C.Browsers started caching DNS forever; flush the caches
- D.Browsers began using DNS over HTTPS to public resolvers, bypassing corporate DNS; enforce the enterprise resolver through policy and block known DoH endpoints
Show answer
Answer: D. Browsers began using DNS over HTTPS to public resolvers, bypassing corporate DNS; enforce the enterprise resolver through policy and block known DoH endpoints
DoH sends DNS inside HTTPS, so it looks like normal web traffic and skips the corporate resolver and its logging and filtering. Enterprises can disable or point DoH to their own resolver through browser and OS policies, and block public DoH providers at the proxy. Malware can also use DoH, so endpoint telemetry of DNS queries helps.
43. Why JA4 replaced JA3
Your team fingerprints TLS clients without decryption. JA3 hashes for Chrome started changing on almost every connection. Why do many teams now prefer JA4?
- A.Chrome randomises the order of TLS extensions, which changes JA3; JA4 sorts extensions so the fingerprint stays stable
- B.JA4 decrypts the TLS session to read the payload
- C.JA3 only works with TLS 1.0
- D.JA4 uses the server certificate instead of the ClientHello
Show answer
Answer: A. Chrome randomises the order of TLS extensions, which changes JA3; JA4 sorts extensions so the fingerprint stays stable
JA3 hashes ClientHello fields in the order they appear, and Chrome began randomising extension order to stop fingerprint ossification. JA4 sorts extensions and adds readable parts like TLS version and ALPN, so fingerprints are stable and easier to use in hunts. Neither method decrypts traffic.
44. Hardening against NTLM relay
A penetration test showed that NTLM authentication captured on the network could be relayed to file servers and LDAP. Which set of controls best mitigates this?
- A.Make all passwords 8 characters long
- B.Turn off Windows Firewall to reduce noise
- C.Use NTLMv1 instead of NTLMv2
- D.Require SMB signing, enforce LDAP signing and channel binding, enable EPA on web services, and reduce NTLM use
Show answer
Answer: D. Require SMB signing, enforce LDAP signing and channel binding, enable EPA on web services, and reduce NTLM use
NTLM relay works when the target accepts authentication that is not tied to the session. SMB signing, LDAP signing with channel binding and Extended Protection for Authentication bind the authentication to the connection, so relayed attempts fail. Phasing out NTLM in favour of Kerberos removes the root problem.
45. Surviving a SYN flood
A web server gets a flood of SYN packets from spoofed IPs, and its half-open connection queue fills up. Which server-side defence lets it keep accepting real clients?
- A.SYN cookies, keeping no state until the ACK
- B.Raising the TCP receive window size a lot
- C.Turning off TCP keepalives on the server
- D.Blocking all ICMP traffic on the server
Show answer
Answer: A. SYN cookies, keeping no state until the ACK
With SYN cookies, the server encodes connection details in its SYN-ACK sequence number and keeps nothing in the queue. Only clients that return a valid ACK get a connection. Large floods still need upstream DDoS scrubbing.
46. Size of a DNS amplification attack
An attacker sends 60-byte DNS queries with a spoofed source to open resolvers, which reply with 3,000-byte answers. If the attacker sends 100 Mbps of queries, about how much hits the victim?
- A.300 Mbps
- B.50 Mbps
- C.5 Gbps
- D.30 Gbps
Show answer
Answer: C. 5 Gbps
The amplification factor is 3,000 ÷ 60 = 50. So 100 Mbps × 50 = 5,000 Mbps, or 5 Gbps aimed at the victim. That is why open resolvers are dangerous and why ISPs should drop spoofed source addresses (BCP 38).
47. Blocking all ICMP broke large transfers
After an admin blocked all ICMP on the firewall, small web pages load but large downloads over a VPN hang. Why?
- A.TCP needs ping replies to stay connected
- B.DNS runs over ICMP for large answers
- C.VPNs only work when ping is allowed
- D.Path MTU discovery needs ICMP "too big" messages
Show answer
Answer: D. Path MTU discovery needs ICMP "too big" messages
Hosts learn the largest packet size a path allows from ICMP "fragmentation needed" (IPv4) or "packet too big" (IPv6) messages. If those are blocked, large packets with the don't-fragment bit vanish and transfers stall. Allow those ICMP types even when blocking echo.
48. Fragments that slip past an IDS
An attacker splits an exploit into small, overlapping IP fragments. The IDS sees nothing, but the target server is exploited. What went wrong?
- A.The IDS does not log any fragmented packets
- B.The IDS and target reassembled them differently
- C.IP fragments are always encrypted in transit
- D.The target server blocked all of the fragments
Show answer
Answer: B. The IDS and target reassembled them differently
Operating systems differ in how they handle overlapping fragments. If the IDS reassembles differently from the target, it inspects a different payload. Tools such as Suricata use target-based reassembly policies, and normalising or dropping odd fragments at the edge helps.
49. Split tunnelling on the VPN
Remote staff use a VPN with split tunnelling: company apps go through the tunnel and everything else goes straight to the internet. What is the main security trade-off?
- A.Company apps are no longer encrypted at all
- B.The VPN uses more bandwidth at head office
- C.Web traffic skips company filtering and logs
- D.Users cannot reach any company apps at all
Show answer
Answer: C. Web traffic skips company filtering and logs
Split tunnelling saves bandwidth and improves speed, but internet traffic bypasses the corporate proxy, DNS filtering and logging. A laptop can be infected from the web while connected to internal apps. Endpoint web protection or a cloud SWG closes the gap.
50. Where did the certificate details go?
After servers moved to TLS 1.3, your Zeek x509 logs for those sessions became empty, while ssl.log still has the server name. Why?
- A.Zeek does not support TLS 1.3 at all
- B.TLS 1.3 removed certificates from the protocol
- C.The SNI field is now encrypted too
- D.TLS 1.3 encrypts the server certificate in the handshake
Show answer
Answer: D. TLS 1.3 encrypts the server certificate in the handshake
In TLS 1.2, the server certificate is sent in clear text, so sensors log it. TLS 1.3 encrypts everything after Server Hello, including the certificate. SNI is still visible unless Encrypted Client Hello is used, so plan detections around SNI, JA4 and endpoint data.
51. A connection open for 30 hours
Zeek conn.log shows a workstation with a TCP connection to an unknown cloud IP lasting 30 hours, with small, steady byte counts both ways. Why hunt this?
- A.Long sessions are always software updates
- B.Long, quiet sessions fit C2 or a reverse tunnel
- C.Zeek only logs connections that are malicious
- D.Workstations cannot keep connections that long
Show answer
Answer: B. Long, quiet sessions fit C2 or a reverse tunnel
Some C2 tools and tunnels hold one long connection open and send small amounts of data. Sorting conn.log by duration and removing known services like VPNs and chat apps leaves a short list worth checking. Pair it with the process from endpoint logs.
52. A Suricata rule that hurts performance
A new Suricata rule uses only a pcre, with no content keyword, and sensor CPU jumps. Why?
alert http any any -> any any (msg:"Odd token"; pcre:"/[A-Za-z0-9]{40}\.php/U"; sid:1000301; rev:1;)- A.pcre cannot be used on HTTP traffic at all
- B.The sid is outside the range allowed for rules
- C.Rules need a threshold keyword to compile well
- D.With no content pre-filter, the regex runs on all
Show answer
Answer: D. With no content pre-filter, the regex runs on all
Suricata uses content patterns as a fast pattern to pick which rules to evaluate. With no content, the costly regex runs on every HTTP request. Add a distinctive content match, such as ".php" in http.uri, so pcre only runs on candidates.
53. Reading sampled NetFlow
A router exports NetFlow with 1-in-1,000 packet sampling. A flow record shows 3 packets to a suspicious IP. What can you conclude?
- A.Exactly 3 packets were sent to that IP
- B.No more than 1,000 packets were sent in all
- C.About 3,000 were sent; small flows can be missed
- D.The flow was blocked by the router itself
Show answer
Answer: C. About 3,000 were sent; small flows can be missed
With 1:1,000 sampling, each recorded packet stands for about 1,000, so 3 sampled packets suggests about 3,000. Short conversations of a few packets are often not sampled at all, so sampled flows can miss low-and-slow C2. Use unsampled flows where you need that.
54. The capture shows only the firewall IP
You capture on the internet side of the firewall to find which laptop talks to a C2 IP. Every packet shows the firewall's public IP as the source. What should you do?
- A.Conclude that the firewall itself is infected
- B.Capture inside, or match NAT logs by time and port
- C.Use a display filter of ip.src == laptop
- D.Ask the C2 server's hosting company for its logs
Show answer
Answer: B. Capture inside, or match NAT logs by time and port
Outside the firewall, NAT has already replaced the internal source address. Either capture on the inside interface or use the firewall's NAT session logs, matching the translated source port and time, to find the real host.
55. Traffic on UDP 443
Your web gateway inspects HTTPS on TCP 443, yet users still reach some blocked sites in Chrome. Firewall logs show heavy UDP 443 traffic. What is going on?
- A.UDP 443 is DNS traffic for those blocked sites
- B.Chrome uses QUIC over UDP, which is not inspected
- C.UDP 443 is only used by remote VPN clients
- D.The gateway is blocking TCP 443 by mistake
Show answer
Answer: B. Chrome uses QUIC over UDP, which is not inspected
QUIC carries HTTP/3 over UDP 443 with its own encryption, so a gateway that only inspects TCP misses it. Blocking UDP 443, or disabling QUIC by browser policy, makes browsers fall back to TCP TLS, which the gateway can inspect.
56. Pivoting on a C2 certificate
One confirmed C2 server uses a self-signed certificate with an unusual subject. How can network logs find more of the attacker's servers?
- A.Search for the same certificate hash or subject on other IPs
- B.Block every self-signed certificate on the internet
- C.Search for the same TCP window size
- D.Look for other servers on port 443
Show answer
Answer: A. Search for the same certificate hash or subject on other IPs
Attackers often reuse the same certificate or template across servers. Searching Zeek x509 logs or internet scan data for the same fingerprint or odd subject can reveal more C2 IPs and infected hosts. This works for TLS 1.2 or via active scanning.
57. Why IMDSv2 blunts SSRF
An SSRF bug lets attackers make the web app send GET requests to any URL. How does requiring IMDSv2 on the EC2 instance protect its role credentials?
- A.IMDSv2 moves the service to a public IP
- B.IMDSv2 needs a token from a PUT with a special header first
- C.IMDSv2 encrypts the credentials with the user's password
- D.IMDSv2 only answers requests from AWS staff
Show answer
Answer: B. IMDSv2 needs a token from a PUT with a special header first
With IMDSv2, a client must first send a PUT request with a TTL header to get a session token, then send it in a header. Most SSRF bugs only allow simple GETs, so they cannot get the token. A hop limit of 1 also stops containers from reaching it through extra hops.
58. Limiting server egress to known domains
Private servers reach the internet through a NAT gateway and need only package repositories and one payment API. How can you allow just those domains?
- A.Add the domains to the NAT gateway's own rules
- B.Block all ports except 443 in the security groups
- C.Allow the current IPs of those domains for good
- D.Send egress via a firewall that filters by domain
Show answer
Answer: D. Send egress via a firewall that filters by domain
NAT gateways and security groups only understand IPs and ports, and service IPs change. A cloud firewall (such as AWS Network Firewall) or an egress proxy can allow traffic by domain using SNI or HTTP Host. That blocks C2 and exfiltration to other sites.
59. Exfiltration through the S3 endpoint
Private instances reach S3 through a gateway VPC endpoint and have no internet route. An attacker with access uploads data to their own S3 bucket. How do you stop this?
- A.Remove encryption from all company buckets
- B.Add an endpoint policy allowing only company buckets
- C.Give the instances a public IP to monitor uploads
- D.Turn off CloudTrail for S3 to save costs
Show answer
Answer: B. Add an endpoint policy allowing only company buckets
A VPC endpoint reaches any S3 bucket in the region, including an attacker's, unless its endpoint policy restricts it. Allowing only your own buckets, or your organisation via aws:ResourceOrgID, closes that route. Bucket policies can also require access via your endpoint.
60. A NACL deny that does nothing
A subnet NACL has these inbound rules, but traffic from 203.0.113.0/24 still reaches the instances. Why?
Rule 100 ALLOW 0.0.0.0/0 all
Rule 200 DENY 203.0.113.0/24 all
Rule * DENY 0.0.0.0/0 all
- A.Rule 100 matches first, so rule 200 is never reached
- B.NACLs only apply to outbound traffic
- C.Deny rules need a security group to work
- D.The /24 range is too small for a NACL
Show answer
Answer: A. Rule 100 matches first, so rule 200 is never reached
NACL rules are evaluated in ascending number order and the first match wins. Rule 100 allows everything, so rule 200 is never checked. Give the deny a lower number than the broad allow, such as 90.
