200-201: Understanding Cisco Cybersecurity Operations Fundamentals

DNS uses UDP port 53 for typical queries. UDP traffic directed to destination port 53 and identified as DNS is consistent with a DNS flood, in which a target receives a high volume of DNS requests.

The transferred file payload is carried by the FTP Data packets in frames 14, 16, 18, and 19. TCP stream reassembly combines those payload-bearing segments into the file; the FTP control messages in frames 7 and 21 contain only the resume command and completion status.

tcpdump is an open-source packet-capture utility for Unix-like platforms, including Linux and macOS. It captures and displays network packets from a command line.

NIST SP 800-61 Rev. 2 includes researching suspected malicious activity—such as consulting search engines and knowledge bases—during detection and analysis. Public information about the newly identified trojan family can establish its behavior and help determine the incident before prioritization or containment.

Open-port and version-detection results identify the listening services and applications, such as OpenSSH and Apache HTTP Server. The exposed SSH and HTTP services also reveal the server’s externally observable purpose and functionality: remote-access administration and web-service delivery. A port scan does not disclose local UIDs/group identifiers, a configured concurrent-connection limit, or server uptime.