5.7 Identify These Elements Used for Network Profiling 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is profiling traffic to a web server and notices that the majority of connections use TCP port 443, but there is a small amount of traffic on TCP port 22. What is the most likely explanation for the port 22 traffic?

   • AAdministrative access to the server for maintenance
   • BA DDoS attack targeting port 22
   • CA misconfigured web server listening on port 22
   • DAn attempt to bypass the firewall by using a non-standard port
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is profiling normal traffic to a database server that is part of the critical asset address space. The analyst notices that most connections last less than 2 seconds, but a few connections last over 30 minutes. What is the most appropriate conclusion about these long-duration connections?

   • AThey should be excluded from the baseline because they are outliers
   • BThey are definitely malicious and should be blocked immediately
   • CThey are likely administrative or backup sessions that should be included in the baseline
   • DThey indicate a network misconfiguration that must be fixed
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network analyst is reviewing a report that shows a sudden increase in total throughput to a single server. The analyst wants to determine whether this is a legitimate surge or a potential denial-of-service attack. Which additional profiling element would be most helpful to make this determination?

   • AThe MAC address of the server's network interface
   • BThe server's physical location in the data center
   • CThe distribution of ports used in the traffic to the server
   • DThe server's operating system version
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security analyst is reviewing network flows and sees that a server has high total throughput on TCP port 443, but the session durations are extremely short (less than 1 second). The server is a web server. What is the most likely explanation?

   • AThe server is misconfigured and using the wrong port
   • BThe server is being used for SSH tunneling
   • CThe server is performing file transfers over HTTPS
   • DThe server is experiencing a high volume of HTTPS requests, possibly a DDoS attack
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which port is commonly associated with HTTPS traffic and is often used as a baseline in network profiling?

   • A80
   • B443
   • C22
   • D21
   Reveal Solution Discussion Select an answer first