nerdexam
Cisco

200-201 · Question #253

Refer to the exhibit. An engineer is analyzing a PCAP file after a recent breach. An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers.

The correct answer is D. by using brute force on the SSH service to gain access. Given the attacker found SSH servers and initiated key exchanges over an encrypted channel that hides data, brute force is the most probable method to gain access to the SSH service in the absence of other specific vulnerability indicators.

Submitted by kev92· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. An engineer is analyzing a PCAP file after a recent breach. An engineer identified that the attacker used an aggressive ARP scan to scan the hosts and found web and SSH servers. Further analysis showed several SSH Server Banner and Key Exchange Initiations. The engineer cannot see the exact data being transmitted over an encrypted channel and cannot identify how the attacker gained access. How did the attacker gain access?

Exhibit

200-201 question #253 exhibit

Options

  • Aby using the buffer overflow in the URL catcher feature for SSH
  • Bby using an SSH Tectia Server vulnerability to enable host-based authentication
  • Cby using an SSH vulnerability to silently redirect connections to the local host
  • Dby using brute force on the SSH service to gain access

How the community answered

(32 responses)
  • A
    9% (3)
  • B
    16% (5)
  • C
    3% (1)
  • D
    72% (23)

Why each option

Given the attacker found SSH servers and initiated key exchanges over an encrypted channel that hides data, brute force is the most probable method to gain access to the SSH service in the absence of other specific vulnerability indicators.

Aby using the buffer overflow in the URL catcher feature for SSH

There is no widely recognized 'URL catcher feature' for SSH, and a buffer overflow would likely cause crashes or abnormal behavior, not just an unidentifiable encrypted session.

Bby using an SSH Tectia Server vulnerability to enable host-based authentication

The prompt does not provide specific indicators for an SSH Tectia Server vulnerability or for the attacker enabling host-based authentication.

Cby using an SSH vulnerability to silently redirect connections to the local host

Silently redirecting connections via an SSH vulnerability is a very specific exploit type, and the scenario provides no evidence to suggest this method of *initial access* was used.

Dby using brute force on the SSH service to gain accessCorrect

The scenario describes an attacker discovering SSH servers, initiating key exchanges, and successfully gaining access without any visible exploit traffic within the encrypted channel. Brute-forcing, which involves systematically trying numerous username and password combinations, is a common method for gaining unauthorized access to SSH services and its attempts would be hidden once an encrypted session is established.

Concept tested: SSH attack methods

Source: https://learn.microsoft.com/en-us/azure/bastion/bastion-faq

Topics

#PCAP analysis#SSH brute force#network reconnaissance#ARP scan

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-201 Practice