2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   A traffic analysis tool is used to monitor network flows, but the analyst notices that some flows are missing from the reports. Which limitation is most likely causing this?

   • ADifficulty with encrypted traffic
   • BLack of deep packet inspection
   • CInability to capture packets
   • DSampling inaccuracies
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   A security analyst is capturing traffic on a busy network segment to investigate a potential breach. Which limitation of packet capture tools is most likely to affect the analysis?

   • AInability to capture packets from wireless networks
   • BInability to capture encrypted payloads
   • CInability to capture IPv6 traffic
   • DInability to capture packets on a switch port
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   Which command-line tool is commonly used for packet capture and is often preferred for its lightweight operation and scripting capabilities on Linux systems?

   • Atcpdump
   • Bnmap
   • Ctraceroute
   • Diperf
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network engineer needs to capture traffic between two virtual machines on the same hypervisor host. The engineer wants to see the full packet contents, including payloads. Which tool or method is most appropriate?

   • AUse NetFlow on the hypervisor's virtual switch to analyze flows.
   • BUse tcpdump on one of the virtual machines to capture traffic on its virtual NIC.
   • CConfigure a SPAN port on the physical switch to capture the traffic.
   • DUse a network tap on the physical cable between the host and the switch.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations center wants to detect a multi-stage attack that involves a phishing email, a malicious download, and a command-and-control connection. The team has access to email logs, proxy logs, and firewall logs. Which tool should the team use to correlate these events?

   • AA SIEM platform to ingest and correlate logs from email, proxy, and firewall sources.
   • BA vulnerability scanner to identify weaknesses in the email server.
   • CA packet capture tool to capture all traffic on the internet gateway.
   • DA flow analyzer to examine NetFlow data from the firewall.
   Reveal Solution Discussion Select an answer first