Network Traffic Monitoring CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network engineer is troubleshooting slow file transfers between two offices connected by a VPN. The monitoring system shows that the VPN link has 5% packet loss and latency of 150 ms. The engineer wants to improve throughput. Which action is most likely to help?

   • AImplement QoS to prioritize file transfer traffic.
   • BIncrease the TCP window size on the file servers.
   • CInvestigate the underlying WAN link for causes of packet loss, such as errors or congestion.
   • DReduce the MTU on the VPN tunnel to avoid fragmentation.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator uses sFlow to monitor a core switch. The sFlow data shows that a single workstation is sending traffic to 50 different external IP addresses on port 53, each flow lasting less than 10 seconds, with a total of 10,000 flows in 5 minutes. Which action is most appropriate?

   • AInvestigate the workstation for malware or a misconfigured DNS resolver.
   • BDisable the workstation's network port to prevent further traffic.
   • CIncrease the sFlow sampling rate to capture more details.
   • DBlock the workstation's IP address immediately.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   While troubleshooting a slow connection to a web server, a technician captures packets with tcpdump. The capture shows a TCP three-way handshake completing, but the client sends an HTTP GET request and then waits for a response. The server's TCP window size is advertised as 0 in the ACK packet. What does this indicate?

   • AThe server is using TCP window scaling to increase throughput.
   • BThe HTTP request was malformed and rejected by the server.
   • CThe server is congested and cannot accept more data at this time.
   • DThe client's network interface is down.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A technician is analyzing a pcap file in Wireshark and sees a packet with a source IP of 10.0.0.1, a destination IP of 10.0.0.255, and a destination MAC address of ff:ff:ff:ff:ff:ff. The packet is a UDP packet. What is this packet?

   • AA multicast packet for a specific group of hosts.
   • BA unicast packet destined for a single host.
   • CA broadcast packet sent to all hosts on the 10.0.0.0/24 subnet.
   • DAn ARP request for the gateway's MAC address.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A technician is analyzing a Wireshark capture and sees a packet with the following details: Source IP 10.0.0.1, Destination IP 10.0.0.255, Protocol UDP, Source port 68, Destination port 67. What is this packet?

   • AA DHCP discover message from a client.
   • BAn ARP request from a client.
   • CA DNS query from a client to a DNS server.
   • DA DHCP offer from a server.
   Reveal Solution Discussion Select an answer first