Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst receives a high-severity alert from a Network Intrusion Detection System (NIDS) monitoring outbound traffic from an internal corporate network segment. The log entry details are shown below:

`[2026-07-27 14:15:02] ALERT: ICMP_LARGE_PAYLOAD_ECHO | Src: 192.168.10.45 | Dst: 203.0.113.88 | Length: 1450 bytes | Rate: 1200 pkts/min | Payload_Header: 504b0304 (PK..)`

Based on this network security monitoring alert, which of the following conclusions and immediate response steps are most appropriate? (Select TWO.)

  1. The alert indicates a potential covert channel utilizing ICMP tunneling to exfiltrate compressed archive files.Answer
  2. B
    The payload header signature indicates a SQL injection payload attempting to query backend database tables.
  3. The analyst should isolate the internal workstation from the network while preserving session packet captures for incident investigation.Answer
  4. D
    The analyst should reconfigure the web application firewall (WAF) to block incoming cross-site scripting (XSS) attacks on port 80.

Answer

The correct conclusions and actions are recognizing that the alert indicates potential ICMP tunneling used for data exfiltration of compressed files, and immediately isolating the compromised workstation while capturing traffic logs for forensic analysis.
ICMP echo requests normally carry minimal data. High volume ICMP traffic carrying 1450-byte payloads with the magic header '504b0304' (Zip file header) signifies data exfiltration via ICMP tunneling. The appropriate incident response steps are isolating the source host to contain potential exfiltration and preserving traffic captures for further investigation.

Step-by-Step Solution

1
Analyze NIDS log parameters
Identified high-frequency ICMP packets with abnormally large payload sizes (1450 bytes) and a payload magic byte header of '504b0304' (Zip file signature).
ICMP traffic is intended for control and diagnostic messaging; embedding large file data headers indicates misuse of the protocol as a covert exfiltration tunnel.
2
Evaluate protocol attack classifications
Distinguished network-level protocol tunneling from web application attacks like SQLi or XSS.
ICMP functions at the Network Layer (Layer 3), whereas SQLi and XSS targets reside at the Application Layer (Layer 7).
3
Determine containment and investigation actions
Selected network isolation of the internal source IP and packet capture log preservation.
Containment halts further exfiltration over the network, while preserving evidence facilitates root cause analysis during incident response.

Key Concept

Network Intrusion Alert Interpretation and ICMP Covert Channel Detection
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic