Network Traffic Monitoring CCT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   Users report that video conferencing is choppy, but web browsing is fine. A network engineer checks the monitoring dashboard and sees that average bandwidth utilization on the WAN link is only 40%, but latency has increased from 20 ms to 200 ms during business hours. Which metric should the engineer examine next to diagnose the issue?

   • AThroughput of the video conferencing server
   • BPacket loss percentage on the WAN link
   • CJitter between consecutive packets
   • DCPU utilization of the router
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A network administrator is using Wireshark to troubleshoot a slow application. The capture shows many TCP packets with the 'TCP Window Full' flag and 'Zero Window' notifications. What is the most likely cause?

   • AThe network link is experiencing high packet loss.
   • BThe receiving application is not reading data from its socket buffer quickly enough.
   • CThe sender is using a very large TCP window size.
   • DThe network is congested and packets are being dropped.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A security analyst is reviewing NetFlow data and sees a large number of flows from many internal hosts to the same external IP address on port 53 (UDP). The flows are short-lived and occur at random intervals. The analyst also notices that the internal hosts are sending DNS queries for domains that are not in the company's approved domain list. What is the most likely explanation?

   • AThe hosts are infected with malware that is using DNS tunneling to exfiltrate data.
   • BThe hosts are performing a distributed denial-of-service (DDoS) attack against the external IP.
   • CThe hosts are scanning the external IP for open ports.
   • DThe external IP is a legitimate DNS server that the hosts are using for recursive resolution.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A network engineer is using Wireshark to troubleshoot a slow application. The capture shows that the client sends a request to the server, and the server responds with a TCP ACK, but the application data does not arrive for 2 seconds. The engineer also notices that the server's TCP window size is consistently small (e.g., 10 KB). What is the most likely cause?

   • AThe server's receive buffer is too small, limiting the amount of data it can accept.
   • BThe client is not sending enough data to fill the window.
   • CThe application is using UDP instead of TCP.
   • DThe network has high latency, causing the 2-second delay.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Why is network traffic monitoring important for security?

   • AIt eliminates the need for security policies
   • BIt prevents all malware from entering the network
   • CIt encrypts all data transmitted across the network
   • DIt provides visibility into network activity that can reveal signs of intrusion or malicious behavior
   Reveal Solution Discussion Select an answer first