Network Traffic Monitoring and Analysis CND Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is reviewing NetFlow data and sees a single internal host communicating with a known malicious IP over port 443 (HTTPS). The traffic is continuous and has been going on for several hours. The host is a web server that normally only receives inbound connections. What is the most likely interpretation?

   • AThe traffic is a false positive because HTTPS is encrypted.
   • BThe web server is performing a legitimate software update.
   • CThe web server is serving web pages to a client on that IP.
   • DThe web server may be compromised and is communicating with a command-and-control server over HTTPS.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of correlating network traffic data with security events?

   • ATo automatically patch vulnerabilities in network devices.
   • BTo identify the context and impact of a security incident by linking related events.
   • CTo replace the need for intrusion detection systems.
   • DTo encrypt all traffic between network devices.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network team is implementing a monitoring solution and wants to detect anomalies such as a sudden spike in DNS queries. They have collected baseline data showing that DNS queries average 100 per minute with a standard deviation of 20. Which threshold would be most appropriate to trigger an alert for a potential anomaly?

   • AAny value above 140 queries per minute.
   • BAny value above 120 queries per minute.
   • CAny value above 200 queries per minute.
   • DAny value above 100 queries per minute.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is correlating network traffic with security events. They have IDS alerts, firewall logs, and NetFlow data. They want to identify all hosts that communicated with a known malicious IP in the last 24 hours. Which data source is most efficient for this task?

   • AFirewall logs, because they show all allowed connections.
   • BNetFlow data, because it contains flow records with source and destination IPs, allowing quick identification of all hosts.
   • CIDS alerts, because they already identify malicious traffic.
   • DFull packet capture, because it provides the most detail.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary difference between flow-based monitoring (e.g., NetFlow) and packet capture?

   • AFlow-based monitoring requires deep packet inspection, while packet capture does not.
   • BFlow-based monitoring is only used for IPv6 traffic, while packet capture is for IPv4.
   • CFlow-based monitoring summarizes metadata about conversations, while packet capture records the full content of each packet.
   • DFlow-based monitoring captures the full payload of every packet, while packet capture only records header information.
   Reveal Solution Discussion Select an answer first