2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is a key function of a network log analysis tool in a security incident investigation?

   • AScanning for vulnerabilities
   • BGenerating flow records
   • CCapturing raw packets for forensic analysis
   • DCorrelating events from multiple sources
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center (SOC) receives logs from firewalls, IDS/IPS, and authentication servers. The SOC wants to correlate a specific user's failed login attempts with firewall blocks that occurred at the same time. Which tool is most appropriate for this task?

   • AA flow analysis tool that displays NetFlow data from the core router.
   • BA packet capture tool that records all traffic on the internal network.
   • CA single firewall's built-in log viewer.
   • DA network log analysis tool that aggregates and correlates logs from multiple sources.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC is correlating logs from multiple sources to identify a multi-stage attack. The analysts notice that events from the firewall and the IDS are not aligning correctly, even though both devices are configured to send logs to the same SIEM. The SIEM shows that the firewall logs are delayed by about 5 minutes compared to the IDS logs. What is the most likely cause and the best corrective action?

   • AThe SIEM is sampling the logs; disable sampling for the firewall logs.
   • BThe devices have different time zones; configure both to use UTC in their logs.
   • CThe firewall is buffering logs before sending them; reduce the buffer size or use reliable log forwarding.
   • DThe IDS is generating logs with incorrect timestamps; reconfigure the IDS's NTP settings.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network engineer is asked to capture traffic for a legal investigation. The traffic is encrypted TLS, and the engineer has access to the server's private key. The capture must be complete and legally admissible. The engineer has a capture appliance with limited storage. What is the most important consideration?

   • AEnsure the capture includes the full TLS handshake and all packets, and store the private key securely for decryption.
   • BUse NetFlow to record the flow metadata instead of full packets.
   • CUse a sampling tool to reduce the storage requirements, but ensure the sample is representative.
   • DCapture only the TLS handshake packets to prove the connection occurred.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network engineer must capture all traffic on a high-throughput 10 Gbps link for a 24-hour period to investigate a possible slow data exfiltration. The capture server has a 2 TB RAID array. The engineer estimates the average traffic rate at 3 Gbps. What is the primary constraint the engineer must address?

   • AThe capture tool will not be able to write to the RAID array fast enough, causing disk I/O bottlenecks.
   • BThe capture server's CPU may not keep up with the packet rate, causing dropped packets.
   • CThe RAID array will fill up before the 24-hour capture completes, so the engineer must use capture filters or increase storage.
   • DThe SPAN port will drop packets because it cannot handle the full 10 Gbps line rate.
   Reveal Solution Discussion Select an answer first