Network Traffic Monitoring and Analysis CND Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a best practice for log retention and management?

   • AStore logs in a centralized, secure location with access controls and define a retention period based on compliance and business needs.
   • BKeep logs for at least 10 years regardless of storage cost.
   • CStore logs only on the local device that generated them.
   • DDelete logs as soon as they are generated to save storage space.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of network traffic monitoring in a security operations context?

   • ATo provide a backup of all network configuration files for disaster recovery.
   • BTo collect and analyze data about network activity to detect anomalies, identify threats, and support operational troubleshooting.
   • CTo encrypt all data transmitted across the network to ensure confidentiality.
   • DTo replace the need for firewall rules by automatically blocking all suspicious traffic.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A network administrator is establishing a baseline for a new application that will be deployed across the company. The application is expected to generate a consistent amount of traffic. What is the best practice for creating a reliable baseline?

   • AUse the vendor's documentation to estimate the expected traffic and set that as the baseline.
   • BWait until the application has been in production for a month and then analyze the traffic.
   • CCapture traffic for one hour during the busiest time of day and use that as the baseline.
   • DMonitor the application's traffic during a pilot deployment for at least two weeks, capturing both peak and off-peak usage.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network team has established a baseline for web traffic showing an average of 100 Mbps with occasional spikes to 200 Mbps during business hours. One day, the traffic jumps to 500 Mbps and stays there for several hours. What is the most appropriate first action?

   • AImmediately block the source of the traffic.
   • BIgnore the increase because it is just a spike.
   • CUpdate the baseline to reflect the new traffic level.
   • DInvestigate the cause by examining flow data and packet captures.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is logging network traffic important for security?

   • AIt encrypts all network traffic.
   • BIt provides a historical record that can be used for incident investigation and forensic analysis.
   • CIt reduces the need for network monitoring tools.
   • DIt automatically prevents all cyber attacks.
   Reveal Solution Discussion Select an answer first