2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A network analyst needs to capture traffic between two servers in the same VLAN to troubleshoot a connectivity issue. The analyst has access to the switch that connects both servers. Which approach should the analyst use to capture the traffic?

   • AUse NetFlow on the switch to capture the full packet contents.
   • BConfigure a SPAN port on the switch to mirror the traffic from both server ports to a capture port.
   • CUse tcpdump on one of the servers to capture the traffic.
   • DUse a network TAP inline between the two servers.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team needs to correlate authentication failures from multiple Active Directory domain controllers and VPN concentrators to identify a possible brute-force attack. Which tool should the team use?

   • AA vulnerability scanner to check for weak passwords on the domain controllers.
   • BA packet capture tool like Wireshark to capture authentication traffic on the network.
   • CA SIEM platform such as Splunk or Elastic Stack to ingest and correlate logs from all sources.
   • DA flow analyzer like nfdump to examine network flows between clients and servers.
   Reveal Solution Discussion Select an answer first
4. 43foundation · medium

   Which protocol is commonly used by traffic analysis tools to export flow information from network devices?

   • ASNMP
   • BSyslog
   • CNetFlow
   • DHTTP
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is investigating a suspected data exfiltration that occurred over a 48-hour period on a 40 Gbps backbone link. The team has a capture appliance with 10 TB of storage and a 1 Gbps write speed. The team also has NetFlow data from the router, but the flow exporter is configured with 1:1000 sampling. The team needs to determine the total volume of data transferred to a specific external IP. Which approach is most appropriate?

   • AUse the NetFlow data to estimate the total volume, acknowledging the sampling inaccuracy.
   • BUse tcpdump on the router to capture only traffic to the specific external IP.
   • CRun a full packet capture on the backbone link for the entire 48-hour period.
   • DEnable sFlow on the router with a higher sampling rate to get more accurate flow data.
   Reveal Solution Discussion Select an answer first