Network Traffic Monitoring CCT Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A network administrator is analyzing a pcap file and sees a packet with the following details: Source IP 192.168.1.10, Destination IP 8.8.8.8, Source port 12345, Destination port 53, Protocol UDP. The packet contains a DNS query for 'example.com'. What is the most likely purpose of this packet?

   • AA DNS zone transfer request.
   • BA DNS amplification attack, where the source IP is spoofed.
   • CA malicious DNS tunneling attempt.
   • DA standard DNS query from a client to a recursive resolver.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a network TAP used for?

   • ATo block malicious traffic before it reaches the network
   • BTo provide a physical inline point for capturing all traffic on a link
   • CTo encrypt traffic between two routers
   • DTo convert analog signals to digital signals
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Users in the marketing department report that they cannot access the internet, while users in other departments can. A packet capture on the marketing VLAN shows ARP requests for the default gateway going unanswered. What is the most likely cause?

   • AThe marketing department's switch port is administratively down.
   • BThe marketing VLAN has a DHCP scope exhaustion issue.
   • CThe default gateway is down or unreachable from the marketing VLAN.
   • DThe DNS server is not resolving domain names.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst is reviewing NetFlow data and notices that a single internal host is communicating with an external IP address on TCP port 443, sending a consistent 5 Mbps of traffic every hour for the past week. The host is a file server that normally generates less than 1 Mbps of traffic. What should the analyst do first?

   • AIncrease the NetFlow sampling rate to get more detailed data.
   • BIgnore the traffic because it is encrypted on port 443.
   • CCheck the host's running processes and recent connections to determine if the traffic is legitimate.
   • DBlock the external IP address at the firewall immediately.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When troubleshooting a connectivity issue, what does a packet capture showing repeated TCP SYN retransmissions to a server indicate?

   • AThe client is sending too much data
   • BThe server is not responding to connection requests, possibly due to being down or blocked
   • CThe DNS resolution is failing
   • DThe network is experiencing high latency but is otherwise functional
   Reveal Solution Discussion Select an answer first