A security analyst notices that a server is sending a large amount of traffic to an external IP address on port 53, but the packet sizes are consistently 512 bytes. The analyst suspects DNS tunneling. Which additional evidence would most strongly support this suspicion?

The DNS queries contain encoded data in the subdomain labels.

The external IP address is a known DNS server.

The server is a domain controller.

The DNS queries are for domains that are not in the company's approved domain list.

A network technician is analyzing a Wireshark capture and sees a TCP packet with the flags [RST, ACK]. The packet is sent from the server to the client immediately after a SYN packet from the client. What is the most likely explanation?

The server is experiencing a SYN flood and is dropping the connection.

The server is refusing the connection because the destination port is closed.

The client is resetting the connection because it received an unexpected packet.

The server is acknowledging the SYN and establishing the connection.

EC-CouncilCertified Cybersecurity Technician

Domain 6Objective 2

Network Traffic Monitoring CCT Practice Questions (Page 1)

Part of the Network Monitoring and Troubleshooting domain, which makes up ~14% of our current practice bank.

45questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
In a captured Ethernet frame, which field identifies the network protocol being carried in the payload?
Select an answer first
2expert · hard
A security analyst notices that a server is sending a large amount of traffic to an external IP address on port 53, but the packet sizes are consistently 512 bytes. The analyst suspects DNS tunneling. Which additional evidence would most strongly support this suspicion?
Select an answer first
3expert · hard
A network technician is analyzing a Wireshark capture and sees a TCP packet with the flags [RST, ACK]. The packet is sent from the server to the client immediately after a SYN packet from the client. What is the most likely explanation?
Select an answer first
4foundation · easy
Which metric measures the percentage of data packets that fail to reach their destination?
Select an answer first
5foundation · easy
Which tool is a command-line packet capture utility commonly available on Linux systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.

Network Traffic Monitoring CCT Practice Questions (Page 1)

Questions 1–5

In a captured Ethernet frame, which field identifies the network protocol being carried in the payload?

A security analyst notices that a server is sending a large amount of traffic to an external IP address on port 53, but the packet sizes are consistently 512 bytes. The analyst suspects DNS tunneling. Which additional evidence would most strongly support this suspicion?

A network technician is analyzing a Wireshark capture and sees a TCP packet with the flags [RST, ACK]. The packet is sent from the server to the client immediately after a SYN packet from the client. What is the most likely explanation?

Which metric measures the percentage of data packets that fail to reach their destination?

Which tool is a command-line packet capture utility commonly available on Linux systems?

Keep studying — Network Monitoring and Troubleshooting