Examkin

Soru

Zorluk: OrtaNetwork Security Monitoring and Alerting

A network security monitoring sensor flags an alert for anomalous outbound traffic generated by an internal host. The NIDS sensor recorded the following event log details:

Timestamp: 2026-07-27T10:42:19Z
Source IP: 10.4.12.105
Destination IP: 198.51.100.89
Destination Port: 8443/TCP
Configured Inspection Rule: Expect HTTPS / TLS Application Protocol
Observed Banner Payload: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.1

Which of the following is the most accurate analysis of this network alert?

  1. Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.Cevap
  2. B
    A web application attack attempting to execute a SQL injection exploit against an external web server.
  3. C
    A control configuration error requiring the inline deployment of a web application firewall to prevent network-level protocol mismatches.
  4. D
    A deception technology misconfiguration failing to drop malicious outbound Command and Control communications.

Cevap

Protocol encapsulation mismatch indicating an attempt to tunnel SSH traffic over a non-standard port to evade network egress filtering.
The correct analysis recognizes that the NIDS sensor flagged a protocol mismatch where an SSH handshake banner ('SSH-2.0-OpenSSH...') was transmitted over port 8443, a port expected to carry TLS-encapsulated HTTPS traffic. Encapsulating non-HTTP protocols over standard or non-standard SSL/TLS ports is a common technique used to tunnel restricted traffic through network firewalls.

Adım Adım Çözüm

1
Analyze the NIDS log fields
Identified that port 8443/TCP was configured to expect TLS/HTTPS traffic, but the observed payload contained the SSH protocol banner 'SSH-2.0-OpenSSH_8.9p1'.
Security monitoring sensors compare expected protocol behavior against inspected packet headers and payload signatures.
2
Determine the attack technique or operational anomaly
Recognized protocol tunneling/encapsulation used for perimeter control evasion.
Attackers or rogue internal hosts often run SSH servers over common HTTPS ports (such as 443 or 8443) to tunnel unauthorized traffic past firewall egress rules.
3
Differentiate correct root cause from distractor controls and attack types
Confirmed that the alert indicates protocol evasion, not SQL injection, WAF misclassification, or honeypot issues.
Deep packet inspection reveals application-layer protocol mismatches regardless of the destination port number used.

Anahtar Kavram

Network Security Monitoring and Protocol Analysis
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru