2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is examining packet captures of traffic between two internal hosts. The analyst notices that the packets have an additional header that is not typical for the application protocol being used. The analyst suspects that the traffic is encapsulated. What is the primary impact of this encapsulation on the analyst's ability to monitor the traffic?

   • AThe encapsulation adds an outer header that hides the original protocol details, so the analyst cannot see the application-layer data without decapsulation.
   • BThe encapsulation encrypts the entire packet, so the analyst cannot see any of the original packet's headers.
   • CThe encapsulation increases the packet size, so the monitoring tool will drop the packets because they exceed the MTU.
   • DThe encapsulation changes the source and destination MAC addresses, so the analyst cannot identify the communicating hosts.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security analyst is configuring a network tap to monitor traffic between two internal subnets. The network team has applied an ACL on the core switch that permits only HTTP and HTTPS traffic between the subnets. The analyst wants to see all traffic, including ICMP and other protocols, for security monitoring. What is the most effective way to ensure the monitoring tool sees all traffic?

   • AConfigure the ACL to permit all traffic to the monitoring tool's SPAN port.
   • BDisable the ACL on the core switch to allow all traffic to pass through.
   • CPlace the network tap on the link between the subnets, before the ACL is applied.
   • DUse NetFlow to capture all traffic, including the packets that are dropped by the ACL.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network analyst is using a protocol analyzer to troubleshoot a slow application. The application traffic is encapsulated in a proprietary tunneling protocol that adds a custom header. The analyzer is not decoding the inner protocol. What is the most likely impact on the analyst's ability to see the application's performance issues?

   • AThe analyst can still see the inner protocol because the analyzer automatically decapsulates all tunnels.
   • BThe analyst can see the application data but not the IP addresses.
   • CThe analyst can only see the outer tunnel headers and cannot analyze the inner application protocol's performance metrics.
   • DThe analyst can see the inner protocol but not the outer tunnel headers.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security analyst is investigating a data breach. The analyst has NetFlow records from the perimeter firewall. The records show a large amount of data being transferred from an internal host to a public IP address. The analyst suspects the data was exfiltrated through a VPN tunnel. The NetFlow records show the VPN gateway's IP as the destination, not the actual external server. What is the most effective way to determine the actual destination of the exfiltrated data?

   • AUse the NetFlow records to trace the traffic back to the original internal host.
   • BConfigure the firewall to block all VPN traffic to prevent further exfiltration.
   • CInspect the VPN gateway's logs to see the decrypted traffic and the actual destination.
   • DUse a packet capture on the internal host to see the encrypted VPN traffic.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is monitoring a network where employees are using a peer-to-peer (P2P) file-sharing application. The analyst is trying to identify which internal hosts are communicating with known malicious peers. What is the main challenge the analyst faces when correlating P2P traffic to specific hosts?

   • AP2P traffic is routed through a central server, so the analyst only sees the server's IP, not the individual peers.
   • BP2P traffic is often encrypted and uses dynamic ports, making it difficult to identify the application and the peers involved.
   • CP2P traffic uses only well-known ports, so the analyst cannot distinguish it from other applications.
   • DP2P traffic is always broadcast to all hosts on the network, so the analyst cannot tell which host initiated the connection.
   Reveal Solution Discussion Select an answer first