Network Traffic Monitoring and Analysis CND Practice Questions (Page 10)

Questions 46–48

1. 46expert · hard

   A security team is designing a log retention strategy. They have limited storage and need to balance the need for forensic investigation with cost. Which approach is most effective?

   • AStore logs on tape and do not index them.
   • BStore detailed logs for 30 days and summarized logs for one year.
   • CStore all logs in raw format for one year on high-performance storage.
   • DStore only alerts from the IDS for one year.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security analyst is correlating network traffic with a security event. The event log shows a successful login from an internal IP at 10:00 AM, but the user was physically in another building. To determine if this was a remote login or a compromised account, which additional data would be most useful?

   • AFull packet capture of the authentication traffic.
   • BFirewall logs for the user's workstation.
   • CNetFlow data showing the source IP of the login session.
   • DVPN logs showing which user connected from which external IP.
   Reveal Solution Discussion Select an answer first
3. 48application · medium

   A security analyst is setting up anomaly detection for a corporate network. To identify deviations from normal behavior, the analyst first needs to establish a baseline. Which action is most appropriate?

   • AGather traffic statistics over a period of weeks to months during normal operations.
   • BCapture traffic for a few hours during peak usage and use that as the baseline.
   • CCollect traffic data during a known attack simulation to use as a reference.
   • DUse the vendor's default baseline provided with the monitoring tool.
   Reveal Solution Discussion Select an answer first