Question bank
Practitioner Intrusion Analyst
40 Practitioner Intrusion Analyst questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Host Based Attacks
10 questions in this domain
- Question 1Single Choice
Which Windows Event ID indicates a successful logon?
- A4624Correct answer
- B4625
- C4688
- D7045
Why this is the answer
Event ID 4624 is logged for successful authentication in the Windows Security log.
- Question 2Multiple Select
Which Linux log files contain authentication information? (Select two)
- A/var/log/auth.logCorrect answer
- B/var/log/syslog
- C/var/log/secureCorrect answer
- D/var/log/boot.log
Why this is the answer
On Linux, authentication messages are typically stored in /var/log/auth.log (Debian) or /var/log/secure (RHEL/CentOS).
- Question 3Interactive
Run a command to display all running processes and their PIDs.
- AtasklistCorrect answer
- Bnetstat
- Cschtasks
- Dwevtutil
Why this is the answer
The 'tasklist' command displays all running processes with their PIDs on Windows.
- Question 4Single Choice
Which Sysmon Event ID logs process creation?
- A1Correct answer
- B3
- C11
- D7
Why this is the answer
Sysmon Event ID 1 (ProcessCreate) logs process creation with command line and parent info.
- Question 5Multiple Select
Which of the following are Windows persistence mechanisms? (Select two)
- ARegistry Run keysCorrect answer
- BScheduled tasksCorrect answer
- CPrefetch files
- DEvent logs
Why this is the answer
Attackers often use Registry Run keys and scheduled tasks to ensure malware runs after reboot.
- Question 6Interactive
Use a command to view all scheduled tasks on a Windows system.
- Aschtasks /queryCorrect answer
- Btasklist /svc
- Cnet start
- Dsc query
Why this is the answer
The 'schtasks /query' command displays all scheduled tasks on the system.
- Question 7Single Choice
Which Windows Event ID indicates the Security log was cleared?
- A1102Correct answer
- B104
- C4698
- D4624
Why this is the answer
Event ID 1102 is recorded when the Windows Security log is manually cleared.
- Question 8Multiple Select
Which two logon types are associated with remote interactive access?
- A10 (RemoteInteractive)Correct answer
- B2 (Interactive)
- C3 (Network)
- D7 (Unlock)Correct answer
Why this is the answer
Logon Type 10 is RemoteInteractive (RDP), and Type 7 is Unlock (often remote after lock).
- Question 9Interactive
Use a Windows command to display the current security event log.
- Awevtutil qe SecurityCorrect answer
- Beventvwr
- CGet-EventLog SecurityCorrect answer
- Dlogman query
Why this is the answer
Both 'wevtutil qe Security' and 'Get-EventLog Security' can be used to query the Security log.
- Question 10Single Choice
Which Linux command is used to view systemd journal logs?
- AjournalctlCorrect answer
- Bdmesg
- Csyslog
- Dlast
Why this is the answer
Journalctl is the command-line tool for querying the systemd journal logs.
Network and Application Attacks
12 questions in this domain
- Question 11Single Choice
What is the primary characteristic of a Denial of Service (DoS) attack?
- AAttack from multiple distributed sources
- BAttack from a single source overwhelming resourcesCorrect answer
- CInterception of communications between two parties
- DCorruption of DNS resolver cache
Why this is the answer
DoS originates from a single source, while DDoS uses multiple sources. MITM and DNS spoofing are different attack types.
- Question 12Multiple Select
Which of the following are types of Man-in-the-Middle (MITM) attacks? (Select two)
- AARP spoofingCorrect answer
- BDNS amplification
- CSession hijackingCorrect answer
- DSYN flood
Why this is the answer
ARP spoofing and session hijacking are MITM techniques; DNS amplification is a DDoS, SYN flood is a DoS.
- Question 13Interactive
Based on the HTTP request shown, what type of attack is being attempted?
- ACross-Site Scripting (XSS)
- BSQL InjectionCorrect answer
- CCross-Site Request Forgery (CSRF)
- DCommand Injection
Why this is the answer
The parameter contains SQL keywords (OR 1=1) and a comment (--), indicating a SQL injection attempt.
- Question 14Single Choice
What is the key difference between reflected and stored XSS?
- AStored XSS is persistent on server; reflected is notCorrect answer
- BReflected XSS affects the attacker only
- CStored XSS requires no user interaction
- DReflected XSS is server-side
Why this is the answer
Stored XSS saves payload in database; reflected XSS appears only in the immediate response.
- Question 15Multiple Select
Which of the following are indicators of a SYN flood attack? (Select two)
- AMany half-open TCP connectionsCorrect answer
- BHigh volume of HTTP requests
- CSYN-ACK responses with no matching SYN
- DA single IP sending many SYN packetsCorrect answer
Why this is the answer
SYN floods cause many half-open connections (SYN_RECEIVED) and originate from one or few IPs.
- Question 16Interactive
Examine the database log entry. What type of attack is likely in progress?
- ABlind SQL injectionCorrect answer
- BCross-Site Scripting
- CCommand injection
- DPrivilege escalation
Why this is the answer
The use of WAITFOR DELAY indicates time-based blind SQL injection, delaying response to infer data.
- Question 17Single Choice
What does DNS spoofing (cache poisoning) typically aim to achieve?
- AOverwhelm DNS servers with traffic
- BRedirect users to malicious IP addressesCorrect answer
- CSteal session cookies from browsers
- DEncrypt DNS communications
Why this is the answer
DNS spoofing corrupts resolver cache, directing traffic to attacker-controlled IPs.
- Question 18Multiple Select
Which of the following are common application layer attacks? (Select two)
- ASQL InjectionCorrect answer
- BSYN Flood
- CCross-Site Scripting (XSS)Correct answer
- DARP spoofing
Why this is the answer
SQLi and XSS are application-layer; SYN flood is transport layer, ARP is data link.
- Question 19Interactive
The following PCAP snippet shows an ARP reply. What attack is likely being performed?
- AARP spoofing (MITM)Correct answer
- BDNS poisoning
- CDHCP starvation
- DMAC flooding
Why this is the answer
Unsolicited ARP replies mapping a gateway IP to a different MAC indicate ARP spoofing.
- Question 20Single Choice
What is the main purpose of Cross-Site Request Forgery (CSRF)?
- AInject malicious scripts into web pages
- BMake authenticated users perform unintended actionsCorrect answer
- CExtract database contents via UNION queries
- DOverload web servers with traffic
Why this is the answer
CSRF tricks a user's browser into sending forged requests using the user's session.
- Question 21Multiple Select
Which of the following are examples of injection attacks? (Select two)
- ASQL injectionCorrect answer
- BCross-Site Scripting
- CCommand injectionCorrect answer
- DDNS amplification
Why this is the answer
SQLi and command injection inject code into interpreters; XSS is script injection but often separate category.
- Question 22Interactive
Analyze the HTTP header. What attack does this indicate?
- AServer information disclosureCorrect answer
- BDirectory traversal
- CSQL injection
- DMissing CSRF token
Why this is the answer
Revealing the server version (Apache/2.4.49) allows attackers to target known vulnerabilities.
Network and Host Based Investigation
10 questions in this domain
- Question 23Single Choice
What is the primary role of Snort according to the document?
- ASignature-based NIDSCorrect answer
- BProtocol analysis framework
- CMulti-threaded inline IPS
- DApplication-layer firewall
Why this is the answer
Snort is defined as a signature-based NIDS that uses rule files for real-time packet analysis.
- Question 24Multiple Select
Which of the following are features of Suricata as per the document?
- AMulti-threadingCorrect answer
- BInline preventionCorrect answer
- CSignature-based detection only
- DNative TLS protocol supportCorrect answer
Why this is the answer
Suricata features multi-threading, inline prevention, and native TLS/HTTP support; it extends Snort-compatible rules.
- Question 25Interactive
An analyst runs the command shown. What type of log file does Zeek primarily generate?
- Aconn.logCorrect answer
- Beve.json
- Cfast.log
- Dalert.log
Why this is the answer
Zeek's default log is conn.log, which records per-connection metadata, distinct from Suricata's JSON output.
- Question 26Single Choice
What does Zeek primarily produce according to the document?
- AHigh-level protocol logsCorrect answer
- BReal-time intrusion alerts
- CPacket-level signatures
- DInline blocking decisions
Why this is the answer
Zeek is a network analysis framework that produces structured logs (e.g., conn.log, http.log), not alerts.
- Question 27Multiple Select
Which alert formats are supported by Snort as mentioned in the document?
- Aunified2Correct answer
- BsyslogCorrect answer
- CJSON
- DCSV
Why this is the answer
Snort uses unified2 and syslog formats; JSON is Suricata's output (eve.json). CSV is not standard.
- Question 28Interactive
Analyze this Suricata rule header. What action is defined in the rule?
- AalertCorrect answer
- Bdrop
- Cpass
- Dreject
Why this is the answer
The rule starts with 'alert', meaning it only logs the event without dropping traffic.
- Question 29Single Choice
What is the first step in log correlation according to the document?
- ANormalize timestampsCorrect answer
- BRun SIEM rules
- CBlock suspicious IPs
- DGenerate reports
Why this is the answer
Normalizing timestamps to a common time zone (e.g., UTC) is essential to align events from different sources.
- Question 30Multiple Select
Which are common challenges in log correlation as per the document?
- AClock skew between devicesCorrect answer
- BTime zone differencesCorrect answer
- CMissing logs due to rotationCorrect answer
- DToo many alerts from SIEM
Why this is the answer
Clock skew, time zones, and missing logs directly affect accurate correlation; alert volume is a separate issue.
- Question 31Interactive
Given the two log entries below, which event occurred first after normalizing to UTC?
- AEvent ACorrect answer
- BEvent B
- CBoth occur simultaneously
- DCannot determine
Why this is the answer
Event A at UTC 02:00 is earlier than Event B at UTC 02:05 after normalizing the time zones.
- Question 32Single Choice
What do correlation rules typically link events based on?
- AConditions, time windows, thresholdsCorrect answer
- BOnly source IP addresses
- COnly event severity scores
- DRandom sampling
Why this is the answer
Correlation rules use conditions, time windows, and thresholds to define meaningful event relationships.
Overview of the Intrusion Analysis Process
8 questions in this domain
- Question 33Single Choice
Which phase of the incident response lifecycle involves establishing and maintaining tools, playbooks, and training?
- APreparationCorrect answer
- BDetection
- CContainment
- DRecovery
Why this is the answer
Preparation is the phase where incident response capabilities, including tools and playbooks, are established and maintained.
- Question 34Multiple Select
Which of the following are phases in the incident response lifecycle? (Select two)
- APreparationCorrect answer
- BAssessment
- CEradicationCorrect answer
- DEvaluation
Why this is the answer
The incident response lifecycle includes Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity.
- Question 35Interactive
Based on the code block below, which phase of the incident response lifecycle is most directly associated with the action described?
- ADetectionCorrect answer
- BContainment
- CEradication
- DRecovery
Why this is the answer
The log entry shows an alert trigger, which is part of detection – identifying potential incidents through monitoring.
- Question 36Single Choice
In the incident response lifecycle, which phase involves removing the root cause of the incident, such as deleting malware?
- AEradicationCorrect answer
- BRecovery
- CContainment
- DAnalysis
Why this is the answer
Eradication is specifically about removing the root cause, such as malware, backdoors, or compromised accounts.
- Question 37Multiple Select
Which of the following activities are part of the Preparation phase? (Select two)
- ACreating playbooksCorrect answer
- BRemoving malware
- CDeploying loggingCorrect answer
- DRestoring backups
Why this is the answer
Preparation includes establishing response capabilities, creating playbooks, deploying logging, and training. Removing malware is eradication, and restoring backups is recovery.
- Question 38Interactive
Based on the action described in the code block, which phase of the incident response lifecycle is being executed?
- AContainmentCorrect answer
- BRecovery
- CEradication
- DPost-Incident
Why this is the answer
Isolating a host from the network is a containment action to stop the incident from spreading.
- Question 39Single Choice
What is the primary purpose of the Post-Incident Activity phase?
- ALessons learned and continuous improvementCorrect answer
- BSystem restoration
- CThreat eradication
- DImmediate containment
Why this is the answer
The Post-Incident phase involves a retrospective to capture improvements, updating playbooks, and driving continuous improvement.
- Question 40Multiple Select
Which of the following are common traps when understanding the incident response lifecycle? (Select two)
- AConfusing eradication with recoveryCorrect answer
- BBelieving containment always precedes analysisCorrect answer
- CThinking preparation is irrelevant to analysts
- DAssuming the lifecycle is strictly linear
Why this is the answer
Common traps include confusing eradication with recovery and thinking containment must always precede analysis; however, the lifecycle is iterative, and preparation is essential.
Frequently asked questions
Everything about the Practitioner Intrusion Analyst question bank and how to use it.