Network Traffic Monitoring CCT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is using Wireshark to examine a pcap file. The analyst filters for HTTP traffic and sees a series of GET requests to a single external IP, each requesting a different path that contains a long string of hexadecimal characters. The requests are spaced exactly 2 seconds apart. What should the analyst suspect?

   • AA network scan using HTTP.
   • BA misconfigured web crawler.
   • CA malware beaconing to a command-and-control server.
   • DA user browsing a website with many images.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which tool is a graphical packet analyzer that allows deep inspection of individual packets?

   • Atcpdump
   • BTraceroute
   • CPing
   • DWireshark
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security team needs to monitor all traffic entering and leaving a data center. The data center has multiple 10 Gbps uplinks to the internet. The team wants to capture full packets for forensic analysis, but the budget only allows for a monitoring appliance that can handle 5 Gbps of sustained capture. What is the best approach?

   • AUse a network TAP on each uplink and aggregate the traffic, but only capture traffic that matches specific security alerts.
   • BUse NetFlow instead of full packet capture to monitor the traffic.
   • CUse port mirroring on the core switch to send all traffic to the monitoring appliance.
   • DCapture traffic only during off-peak hours.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A network engineer is comparing NetFlow and sFlow to monitor a high-speed backbone. The engineer needs to detect DDoS attacks and also perform capacity planning. Which statement correctly describes the trade-off?

   • AsFlow is only used for security monitoring, while NetFlow is only used for capacity planning.
   • BNetFlow is always more accurate than sFlow for DDoS detection.
   • CsFlow uses packet sampling, which reduces CPU load but may miss short-lived flows, while NetFlow tracks all flows but can be more resource-intensive.
   • DNetFlow provides full packet capture, while sFlow provides only flow summaries.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A network team needs to monitor traffic on a 10 Gbps backbone link between two core switches. They have a monitoring appliance that supports 10 Gbps capture. The team wants to minimize any impact on the production link. Which method should they choose?

   • AUse NetFlow on the switches to export flow data to the monitoring appliance.
   • BConfigure a SPAN port on one of the core switches to mirror the backbone link.
   • CInstall an inline network TAP on the backbone link and connect the monitoring appliance to the TAP's monitor ports.
   • DConnect the monitoring appliance to a spare port on one switch and use tcpdump to capture all traffic.
   Reveal Solution Discussion Select an answer first