Network Traffic Monitoring CCT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following traffic patterns is most likely to indicate a security threat?

   • APeriodic software update downloads from a vendor's update server
   • BRegular DNS queries to a corporate DNS server
   • CA sudden increase in outbound traffic to an unfamiliar external IP address at 3:00 AM
   • DA single large file transfer from a known server during business hours
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network administrator needs to capture traffic between two servers on the same switch to investigate a suspected data exfiltration. The switch supports port mirroring, but the administrator is concerned about missing packets during peak hours. Which approach should the administrator use to ensure the most reliable capture?

   • AConfigure a SPAN port on the switch to mirror traffic from both server ports to a monitoring port.
   • BEnable NetFlow on the switch to record flow summaries and analyze them for anomalies.
   • CInstall a network TAP inline between each server and the switch, connecting the TAP's monitor ports to a capture device.
   • DUse Wireshark on each server to capture traffic locally and then compare the captures.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network engineer needs to capture traffic between two virtual machines (VMs) running on the same hypervisor host. The VMs are on the same virtual switch. Which method will capture this traffic?

   • AEnable NetFlow on the hypervisor's management interface.
   • BPlace a network TAP between the VMs on the physical network.
   • CUse Wireshark on the hypervisor's physical NIC.
   • DConfigure port mirroring on the virtual switch to send traffic to a monitoring VM.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A user reports slow internet access. Using traffic monitoring, you notice high bandwidth utilization on the link. What is the most likely conclusion?

   • AThe user's computer is infected with malware
   • BThe network is experiencing a security breach
   • CThe DNS server is misconfigured
   • DThe link is congested, causing performance degradation
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A small business wants to monitor its network for security threats but has a limited budget and no dedicated security staff. The business needs to see traffic patterns and detect anomalies without capturing full packets. Which solution is most appropriate?

   • AInstall a packet sniffer on every workstation to monitor local traffic.
   • BEnable NetFlow or sFlow on the existing router and use a flow collector to analyze traffic patterns.
   • CUse PRTG to monitor SNMP metrics only, such as CPU and memory usage.
   • DDeploy a network TAP and use Wireshark to capture all traffic continuously.
   Reveal Solution Discussion Select an answer first