2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is using Wireshark to analyze a packet capture from a compromised host. The analyst needs to see the contents of an HTTPS session. The analyst has the server's private key. What should the analyst do to view the decrypted traffic?

   • AUse NetFlow to analyze the HTTPS session.
   • BConfigure Wireshark with the server's private key and the appropriate SSL/TLS protocol preferences.
   • CUse a network log analysis tool to correlate the HTTPS session with other logs.
   • DUse a packet capture filter to capture only the HTTPS traffic.
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   A security operations center (SOC) needs to collect logs from firewalls, servers, and applications into a central location for analysis. Which type of tool is designed for this purpose?

   • ATraffic analysis tool
   • BPacket capture tool
   • CVulnerability scanner
   • DNetwork log analysis tool
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing logs from multiple network devices to trace an attack path. The analyst notices that some devices do not log certain events, such as failed login attempts on a legacy switch. What limitation of network log analysis tools is the analyst encountering?

   • ALog volume, because the switch generates too many logs to store.
   • BIncomplete logging, because the device does not generate logs for all events.
   • CTime synchronization issues, because the switch's clock is not synchronized.
   • DLack of deep packet inspection, because the logs do not contain payload data.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A network engineer needs to capture traffic on a high-availability link between two data centers to troubleshoot an application performance issue. The engineer has a server with two 10 Gbps NICs and a RAID array. The link is a 10 Gbps link. Which capture strategy is most appropriate?

   • AUse a SPAN port on the switch and capture all traffic to the server's RAID array.
   • BUse Wireshark on the server to capture and analyze the traffic in real time.
   • CUse a network TAP to split traffic and capture only the relevant application's traffic using a capture filter.
   • DUse tcpdump on the server's NIC without any filters and write to a single SSD.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is using a traffic analysis tool to identify a possible DNS tunneling attack. The tool provides flow data but not the content of DNS queries. What should the analyst do to gain more visibility into the DNS payloads?

   • AEnable NetFlow v9 on the router to include additional flow fields.
   • BUse a log analysis tool to parse DNS server logs for unusual query patterns.
   • CUse a packet capture tool on the DNS server to capture and inspect the DNS query payloads.
   • DIncrease the sampling rate on the flow exporter to capture more flow records.
   Reveal Solution Discussion Select an answer first