5.3 Perform Packet Capture and Analysis Using Wireshark, Tcpdump, SPAN, ERSPAN, and RSPAN CCIE-SECURITY Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has two switches in different buildings connected by a trunk link. Security analysts need to capture traffic from a server connected to the first switch, but the monitoring workstation is connected to the second switch. Which method should be used to mirror the server's traffic to the monitoring workstation?

   • AConfigure RSPAN on both switches using a dedicated RSPAN VLAN.
   • BConfigure ERSPAN to encapsulate the mirrored traffic and send it to the workstation's IP address.
   • CUse tcpdump on the server itself to capture traffic and send the file to the workstation.
   • DConfigure a local SPAN session on the first switch and connect the workstation to a port on that switch.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team needs to monitor traffic from a switch in a remote branch office. The monitoring server is located at the corporate headquarters, and the two sites are connected via a routed WAN link. The team wants to capture the mirrored traffic using Wireshark on the monitoring server. Which method should they use?

   • AUse tcpdump on the branch switch's management interface to capture traffic and send the file to headquarters.
   • BConfigure a local SPAN session on the branch switch and have someone physically connect a laptop to capture traffic.
   • CConfigure ERSPAN on the branch switch to send encapsulated mirrored traffic to the monitoring server's IP address.
   • DConfigure RSPAN on the branch switch and extend the RSPAN VLAN over the WAN.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network administrator is troubleshooting a performance issue on a Linux server. They need to capture only DNS queries and responses to and from the server for a short period. The server has no GUI. Which command should the administrator use?

   • AWireshark -i eth0 -f 'port 53' -w dns.pcap
   • Btcpdump -i eth0 -n host 8.8.8.8 -w dns.pcap
   • Ctcpdump -i eth0 -n udp port 53 -w dns.pcap
   • Dtcpdump -i eth0 -n port 53 -w dns.pcap
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst has captured a pcap file containing suspicious HTTP traffic. The analyst needs to extract the full contents of the HTTP requests and responses to understand the attack. Which Wireshark feature should the analyst use?

   • AExport Objects > HTTP
   • BFollow TCP Stream
   • CStatistics > HTTP > Requests
   • DDisplay filter 'http'
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network engineer needs to monitor traffic from a specific VLAN on a switch. The monitoring device is connected to a port on the same switch. The engineer wants to capture all traffic from that VLAN, including traffic between hosts within the VLAN. Which configuration should be used?

   • AConfigure RSPAN with the VLAN as the source and a remote VLAN as the destination.
   • BConfigure a SPAN session with source VLAN and destination as the monitoring port.
   • CUse ERSPAN to encapsulate the VLAN traffic and send it to the monitoring port.
   • DConfigure a SPAN session with source ports for each host in the VLAN.
   Reveal Solution Discussion Select an answer first