Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A security analyst monitoring network security telemetry reviews the following correlated NIDS alert and NetFlow summary:

[ALERT] NIDS: Suspicious Protocol Anomaly Detected
Timestamp: 2026-07-27T14:22:10Z
Sensor ID: NIDS-PERIMETER-01
Source IP: 10.1.50.88 (Internal Workstation)
Destination IP: 203.0.113.195 (External Host)
Protocol: ICMP Type 8 (Echo Request)
Details: ICMP payload size 1480 bytes; Payload Entropy: 7.92 (High); Request Rate: 450/min

NetFlow Summary (10.1.50.88 -> 203.0.113.195):
Bytes Sent: 52,400,000 | Bytes Received: 12,000 | Total Packets: 35,500

Based on the telemetry provided, which of the following represents the primary threat activity occurring and the most appropriate immediate action?

  1. ICMP tunneling for data exfiltration; immediately isolate host 10.1.50.88 from the network.Answer
  2. B
    Cross-site scripting (XSS) payload delivery; update perimeter web application firewall (WAF) rules to inspect HTTP POST requests.
  3. C
    Misconfigured decoy honeypot alert; reconfigure the NIDS inline to drop passive monitoring logs targeting production decoy servers.
  4. D
    Normal ICMP latency diagnostic polling; reclassify the NIDS detection rule as a detective control and raise the alert threshold.

Answer

ICMP tunneling for data exfiltration; immediately isolate host 10.1.50.88 from the network.
The correct answer identifies ICMP tunneling and specifies immediate host isolation. High payload entropy (7.92), maximum payload size (1480 bytes), and over 52 MB of outbound data transferred over ICMP Echo Requests are classic indicators of data exfiltration via protocol tunneling. Isolating host 10.1.50.88 stops ongoing exfiltration during incident response containment.

Step-by-Step Solution

1
Analyze the protocol anomalies in the NIDS alert.
Identified ICMP Type 8 traffic with abnormally large payload sizes (1480 bytes), a high request rate (450/min), and near-maximum randomness/entropy (7.92).
Standard ICMP ping packets carry small, deterministic payloads. Encrypted or compressed data encapsulated inside ICMP packets exhibits high entropy and maxed-out frame sizes.
2
Correlate packet inspection data with NetFlow volumetric telemetry.
Observed severe volume asymmetry: 52.4 MB sent outbound versus 12 KB received inbound across 35,500 ICMP packets.
Large outbound byte volume compared to minimal return bytes over a control protocol confirms data leaving the network (exfiltration) rather than simple ping sweeping or C2 command reception.
3
Determine the appropriate immediate containment response.
Host isolation of the compromised internal IP (10.1.50.88).
Containment must occur at the source system to stop active data exfiltration before performing detailed root-cause investigation or remediation.

Key Concept

Identifying covert ICMP data exfiltration through protocol anomaly analysis and NetFlow volumetric correlation.
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic