5.3 Perform Packet Capture and Analysis Using Wireshark, Tcpdump, SPAN, ERSPAN, and RSPAN CCIE-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In an RSPAN configuration, what is the role of the RSPAN VLAN?

   • AIt encrypts the mirrored traffic to ensure confidentiality.
   • BIt isolates the monitoring port from all other traffic.
   • CIt provides a separate network for management traffic.
   • DIt carries the mirrored traffic from the source switch to the destination switch.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What encapsulation protocol does ERSPAN use to transport mirrored traffic over an IP network?

   • AIPsec
   • BMPLS
   • CGRE
   • DVXLAN
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to capture traffic on a Linux-based firewall to investigate a suspected malware beacon. The analyst must capture only HTTPS traffic to a specific external IP and save the capture to a file for later analysis in Wireshark. The firewall has no GUI. Which approach should the analyst use?

   • AConfigure a SPAN session on the firewall's switch port and connect a laptop running Wireshark to the monitoring port.
   • BRun tcpdump with a BPF filter for port 443 and host <external IP>, writing output to a .pcap file.
   • CRun tcpdump without any filter to capture all traffic, then use Wireshark's display filter to isolate the HTTPS traffic.
   • DUse Wireshark's remote capture feature to capture traffic from the firewall over SSH.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator needs to capture traffic on a Linux router to troubleshoot a connectivity issue. The administrator wants to capture only ICMP echo requests and replies to and from the router's external interface. Which tcpdump command should be used?

   • Atcpdump -i eth0 port 80
   • Btcpdump -i eth0 icmp
   • Ctcpdump -i eth0 host 192.168.1.1
   • Dtcpdump -i eth0 udp
   Reveal Solution Discussion Select an answer first
6. 15application · medium · select all that apply

   A security analyst has captured a pcap file and needs to identify all packets that contain a specific string in the payload. The analyst is using Wireshark. Which of the following methods can be used to find these packets? (Select all that apply.)

   • AUse the 'Export Objects' feature to extract files
   • BUse the 'Find Packet' feature with a string search
   • CUse the display filter 'frame contains "malware"'
   • DUse the 'Statistics > Protocol Hierarchy' feature
   • EUse the 'Follow TCP Stream' feature and search within the stream
   Check answers Discussion Select an answer first