Cisco Exam 200-201 Topic 5 Question 90 Discussion

Actual exam question for Cisco's 200-201 exam

Question #: 90
Topic #: 5

A user reports difficulties accessing certain external web pages. When an engineer examines traffic to and from the external domain in full packet captures, they notice that many SYNs have the same sequence number, source, and destination IP address, but they have different payloads. What is causing this situation?

ATCP injection

Bmisconfiguration of a web filter

CFailure of the full packet capture solution

Dinsufficient network resources

Show Suggested Answer

Suggested Answer: A

TCP injection is an attack where the attacker sends crafted packets into an existing TCP session. These packets appear to be part of the session.

The presence of many SYN packets with the same sequence number, source, and destination IP but different payloads indicates that an attacker might be injecting packets into the session.

This method can be used to disrupt communication, inject malicious commands, or manipulate the data being transmitted.

Understanding TCP Injection Attacks

Analyzing Packet Captures for Injection Attacks

Network Security Monitoring Techniques

by Joni at Jul 03, 2024, 12:54 PM

Limited Time Offer

25%

Off

Get Premium 200-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noemi

5 months ago

Wait, hold up, are we sure this isn't just a case of the network engineer falling asleep at the keyboard and accidentally leaning on the 'inject malicious traffic' button? Just a thought.

upvoted 0 times

Alison

3 months ago

C) Failure of the full packet capture solution

upvoted 0 times

...

Ryan

3 months ago

B) misconfiguration of a web filter

upvoted 0 times

...

Page

3 months ago

A) TCP injection

upvoted 0 times

...

Whitley

3 months ago

C) Failure of the full packet capture solution

upvoted 0 times

...

Dong

4 months ago

B) misconfiguration of a web filter

upvoted 0 times

...

Luann

4 months ago

A) TCP injection

upvoted 0 times

...

Oneida

5 months ago

I think it could also be insufficient network resources causing the problem.

upvoted 0 times

...

Melinda

5 months ago

Insufficient network resources? That's a classic scapegoat. I bet the network admin just forgot to pay the internet bill. Option D for sure!

upvoted 0 times

Felton

4 months ago

misconfiguration of a web filter

upvoted 0 times

...

Ivette

4 months ago

TCP injection

upvoted 0 times

...

Patria

5 months ago

But wouldn't a failure of the full packet capture solution also cause this?

upvoted 0 times

...

Keshia

5 months ago

I disagree, I believe it's a misconfiguration of a web filter.

upvoted 0 times

...

Flo

5 months ago

Hmm, I'm not sure. Could it be a failure of the full packet capture solution? Option C seems plausible to me. Maybe they need to upgrade their equipment.

upvoted 0 times

...

Nu

5 months ago

I'd go with option B - a misconfiguration of the web filter could be causing these issues. It's important to double-check the filter settings.

upvoted 0 times

Juliana

4 months ago

It's always important to make sure the web filter is set up correctly to avoid issues like this.

upvoted 0 times

...

Tonette

4 months ago

Maybe the engineer should check the settings on the web filter to see if that's the problem.

upvoted 0 times

...

Shaquana

5 months ago

I agree, a misconfiguration could definitely be the issue here.

upvoted 0 times

...

Gussie

5 months ago

Option B seems likely. The web filter might be causing the problem.

upvoted 0 times

...

Patria

5 months ago

I think it might be TCP injection causing this issue.

upvoted 0 times

...

Franklyn

6 months ago

This sounds like a case of TCP injection, where an attacker is injecting malicious traffic into the network. Option A seems like the most likely culprit here.

upvoted 0 times

Desirae

5 months ago

We should investigate further to confirm if it's indeed a case of TCP injection.

upvoted 0 times

...

Timmy

5 months ago

I agree, TCP injection seems like the most probable cause.

upvoted 0 times

...