2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What characteristic of TOR makes it difficult for a security analyst to determine the true destination of a connection?

   • ATOR changes the destination IP address at each relay, so the final destination is never the same.
   • BTOR uses a fixed set of proxy servers that all share the same IP address.
   • CTOR encrypts the destination IP address in the packet header, so it is not visible.
   • DTOR routes traffic through multiple relays, and each relay only knows the next hop, not the final destination.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does load balancing affect the visibility of a complete user session to a monitoring tool?

   • ALoad balancing consolidates all session traffic onto a single server, making it easier to monitor.
   • BLoad balancing encrypts the session, so the monitoring tool cannot see the payload.
   • CLoad balancing spreads session traffic across multiple servers, so a single monitoring point may not see the entire session.
   • DLoad balancing changes the application protocol, so the monitoring tool cannot identify the session.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does The Onion Router (TOR) reduce the visibility of network traffic to a security monitoring tool?

   • ATOR replaces the source IP address with a random IP address, so the origin is hidden.
   • BTOR uses a single proxy server that hides the source IP address.
   • CTOR compresses all traffic, making it impossible to read the payload.
   • DTOR encrypts the traffic in layers and routes it through multiple relays, so the original source and destination are hidden.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A security analyst is reviewing packet captures from a network that uses NAT (Network Address Translation). Why might it be difficult to correlate the captured traffic to the original internal host?

   • ANAT changes the MAC address of the internal host, so the original host cannot be identified.
   • BNAT replaces the internal source IP address with a public IP address, so the original internal address is not visible in the captured packets.
   • CNAT encrypts the payload, so the internal host's data is not readable.
   • DNAT adds an extra header to each packet, hiding the original IP address from monitoring tools.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A network analyst is troubleshooting why a monitoring tool is not seeing traffic that should be flowing between two hosts. The traffic passes through a router that has an access control list (ACL) applied to the interface. What is the most likely reason the monitoring tool is missing the traffic?

   • AThe ACL is blocking the monitoring tool's management interface from receiving the traffic.
   • BThe ACL is encrypting the traffic, making it unreadable to the monitoring tool.
   • CThe ACL is configured to deny the traffic, so the router drops the packets before they can be forwarded to the monitoring tool.
   • DThe ACL is redirecting the traffic to a different VLAN, so the monitoring tool cannot see it.
   Reveal Solution Discussion Select an answer first