Cybersecurity Analyst
Network security questions
136 questions on Network security for cybersecurity analysts, easiest first.
Easy 39
- IDS vs IPSeasy
- What makes a firewall stateful?easy
- The hidden last rule of a firewalleasy
- Default port for SSHeasy
- RDP open to the interneteasy
- Why use a DMZeasy
- Order of the TCP handshakeeasy
- What runs on port 445easy
- What a site-to-site VPN doeseasy
- What NAT doeseasy
- What egress filtering meanseasy
- What a WAF protectseasy
- What TLS gives a connectioneasy
- The protocol behind pingeasy
- Why segment a networkeasy
- What a honeypot is foreasy
- DNS on UDP and TCPeasy
- What a pcap file holdseasy
- Filtering one host in Wiresharkeasy
- Capturing DNS with tcpdumpeasy
- What NetFlow recordseasy
- What Zeek produceseasy
- Suricata's eve.jsoneasy
- Reading a whole conversationeasy
- What a TCP RST meanseasy
- Passwords visible in a captureeasy
- Capture filter or display filter?easy
- The first TLS messageeasy
- The uid field in Zeekeasy
- One source, many portseasy
- Finding the top talkerseasy
- Why flows are kept longer than pcapeasy
- Return traffic in a security groupeasy
- Blocking one IP range in AWSeasy
- What VPC Flow Logs captureeasy
- Which Azure NSG rule winseasy
- Why use a bastion hosteasy
- How a CDN helps against DDoSeasy
- Reaching a database privatelyeasy
Medium 56
- Unusual DNS trafficmedium
- Read a Suricata rulemedium
- Spotting C2 beaconingmedium
- Wireshark filter for HTTP POSTsmedium
- Odd queries in Zeek dns.logmedium
- A rule that never matchesmedium
- Usable hosts in a /24medium
- Which IPs are in a /27medium
- What app identification addsmedium
- How a SYN scan worksmedium
- Closed or filtered in nmap?medium
- ARP spoofing on a LANmedium
- Stopping a rogue DHCP servermedium
- What 802.1X does on a switch portmedium
- VLAN hopping by double taggingmedium
- ESP or AH in IPsecmedium
- What SNI shows on the wiremedium
- Trade-offs of TLS inspectionmedium
- What DNSSEC protectsmedium
- How a DNS sinkhole helpsmedium
- Hardening SSH on a servermedium
- Forward or reverse proxy?medium
- Why Telnet and FTP are riskymedium
- What WPA3-Personal improvesmedium
- An evil twin at the airportmedium
- Showing only connection attemptsmedium
- Finding failed DNS lookupsmedium
- Filtering TLS by server namemedium
- Excluding your own SSH sessionmedium
- Saving a capture for Wiresharkmedium
- conn_state S0 in Zeekmedium
- conn_state REJ in Zeekmedium
- Reading Zeek's history fieldmedium
- Self-signed certificates in ssl.logmedium
- A JPG that is really an EXEmedium
- sid and rev in a Suricata rulemedium
- flow:established,to_servermedium
- content with nocasemedium
- Limiting a noisy Suricata rulemedium
- A drop rule that drops nothingmedium
- Spotting exfiltration in flowsmedium
- Disk for one day of packet capturemedium
- Guessing the OS from TTLmedium
- Two MACs for the gateway in a pcapmedium
- Pings carrying too much datamedium
- SSH open to 0.0.0.0/0medium
- NACL breaks web repliesmedium
- REJECT records in flow logsmedium
- Azure NSG default rulesmedium
- Slowing a login brute force with WAFmedium
- Google Cloud implied firewall rulesmedium
- Allowing the app tier to reach the databasemedium
- ZTNA compared with a VPNmedium
- Pod traffic with no network policymedium
- Admin access with no open portsmedium
- Separating VPCs on a transit gatewaymedium
Hard 41
- What zero trust really meanshard
- DNS logs went quiethard
- Why JA4 replaced JA3hard
- Hardening against NTLM relayhard
- Surviving a SYN floodhard
- Size of a DNS amplification attackhard
- Blocking all ICMP broke large transfershard
- Replies dropped by a stateful firewallhard
- Two sites with the same subnethard
- What RPKI route validation preventshard
- IPv6 left wide openhard
- Fragments that slip past an IDShard
- Stopping SSL strippinghard
- A web page attacking the routerhard
- Will the state table overflow?hard
- Lateral movement inside one VLANhard
- Split tunnelling on the VPNhard
- Apps that fail after TLS inspectionhard
- IDS missing packets from a SPAN porthard
- Where did the certificate details go?hard
- Decrypting your own test traffichard
- Many retransmissions and duplicate ACKshard
- A connection open for 30 hourshard
- A Suricata rule that hurts performancehard
- Matching only inside the URIhard
- Why the IDS missed a web exploithard
- Reading sampled NetFlowhard
- The capture shows only the firewall IPhard
- Traffic on UDP 443hard
- Continuous capture without filling the diskhard
- Feeding IOCs into Zeekhard
- Fail-open or fail-closed IPS?hard
- Pivoting on a C2 certificatehard
- Who started this connection?hard
- Why IMDSv2 blunts SSRFhard
- Limiting server egress to known domainshard
- Peering does not pass throughhard
- What VPC Flow Logs never showhard
- Exfiltration through the S3 endpointhard
- A DDoS that targets the billhard
- A NACL deny that does nothinghard