2.3 Describe the Impact of These Technologies on Data Visibility 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is investigating a malware infection that is using a custom tunneling protocol over port 443 to communicate with a command-and-control (C2) server. The analyst has full packet captures from the network perimeter. What is the primary limitation the analyst will face when trying to inspect the C2 traffic?

   • AThe tunnel uses port 443, which is commonly allowed, so the firewall will drop the traffic before it reaches the analyst.
   • BThe analyst will only see the tunnel's outer header, but the inner packet's source and destination IPs are still visible in the clear.
   • CThe inner payload is encapsulated and possibly encrypted, so deep packet inspection cannot reveal the actual C2 commands.
   • DThe tunnel will cause the packet captures to be incomplete because the traffic is fragmented across multiple packets.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is investigating a web application attack. The application is behind a load balancer that distributes traffic across three web servers. The analyst has full packet captures from the load balancer's external interface. What is the primary challenge the analyst faces when correlating the attack traffic to a specific web server?

   • AThe load balancer uses a different IP address for each web server, so the analyst cannot tell which server is which.
   • BThe load balancer may use source NAT, so the packet captures show the load balancer's IP as the source, not the original client IP.
   • CThe load balancer drops all packets that are not destined to the web servers, so the analyst only sees a subset of the traffic.
   • DThe load balancer encrypts all traffic, so the analyst cannot see the application-layer data.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary effect of tunneling on data visibility for network monitoring tools?

   • ATunneling removes the original headers, so only the payload is visible.
   • BTunneling hides the inner protocol details by encapsulating them in an outer protocol.
   • CTunneling converts the payload to a different format, making it unreadable.
   • DTunneling increases the size of packets, making them easier to inspect.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key characteristic of peer-to-peer (P2P) traffic that makes it challenging for security monitoring?

   • AP2P traffic is generated by a single host, making it easy to trace.
   • BP2P traffic uses only encrypted protocols, so payloads are never visible.
   • CP2P traffic flows directly between peers, so there is no central point where all traffic can be inspected.
   • DP2P traffic is typically short-lived and uses only UDP.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary impact of encapsulation on data visibility for security monitoring?

   • AEncapsulation increases the visibility of the original payload by making it larger.
   • BEncapsulation hides the inner protocol details by adding an outer header, reducing visibility.
   • CEncapsulation converts the payload to a different format, making it unreadable.
   • DEncapsulation removes the inner header, so only the payload is visible.
   Reveal Solution Discussion Select an answer first