Network Traffic Monitoring CCT Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security analyst is reviewing flow data and sees a sudden increase in outbound DNS traffic from a single workstation. The flows show many queries to different domains, each with a short duration and small packet sizes. The workstation is a standard user machine. Which action is the most appropriate first step?

   • ACapture full packets from the workstation to analyze the DNS queries and responses.
   • BIncrease the flow export rate to get more detailed data.
   • CDisable the workstation's DNS client service.
   • DBlock the workstation's internet access immediately.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A network administrator is analyzing NetFlow data and sees a sudden spike in traffic from a single internal host to many external IP addresses on port 445 (SMB). The traffic is occurring at 3:00 AM, which is unusual for the organization. The host is a file server that normally has no outbound SMB traffic. What is the most likely explanation?

   • AThe host is downloading Windows updates.
   • BThe host is being used for peer-to-peer file sharing.
   • CThe host is performing a legitimate backup to an external service.
   • DThe host is compromised and is part of a botnet performing SMB scanning or propagation.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A network administrator is monitoring a WAN link that connects two branch offices. The link is rated for 100 Mbps, but users report slow file transfers. The administrator checks the monitoring dashboard and sees an average throughput of 80 Mbps and a packet loss rate of 2%. What is the most likely cause of the slow transfers?

   • AThe file server's disk is failing.
   • BThe link is not actually 100 Mbps; the ISP is throttling it.
   • CThe users are using Wi-Fi instead of wired connections.
   • DThe link is saturated, and packet loss is causing TCP retransmissions.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network administrator reviews NetFlow data and sees that a particular server has a high number of flows to many different external IP addresses on port 445. The server is a database server that should not be communicating with external hosts on SMB. What should the administrator do first?

   • AInvestigate the server for signs of compromise, such as malware or unauthorized access.
   • BIncrease the NetFlow sampling rate to get more detailed data.
   • CReboot the server to clear any temporary network connections.
   • DBlock all outbound port 445 traffic from the server at the firewall.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A network administrator is troubleshooting intermittent connectivity issues between two offices connected by a VPN over the internet. The administrator captures traffic on both ends and notices that the VPN tunnel is established, but data transfer is slow. The capture shows many TCP retransmissions and duplicate ACKs. What is the most likely cause?

   • AThe VPN encryption algorithm is too weak.
   • BThe VPN tunnel is misconfigured with the wrong encryption keys.
   • CThe MTU size is too large for the VPN tunnel.
   • DThe internet link has high packet loss, causing TCP to retransmit.
   Reveal Solution Discussion Select an answer first