Network Traffic Monitoring and Analysis CND Practice Questions (Page 3)

Questions 11–15

1. 11application · hard

   While analyzing a packet capture, a defender sees a series of TCP packets with the FIN and PSH flags set, followed by a RST. This pattern is often associated with which type of activity?

   • AA port scan using the FIN scan technique.
   • BA denial-of-service attack sending malformed packets.
   • CAn application sending data and then abruptly closing the connection.
   • DA normal file transfer completing successfully.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common method for establishing a network traffic baseline?

   • AConfiguring all routers to log every packet to a central server.
   • BUsing a vulnerability scanner to identify open ports on all hosts.
   • CDeploying a honeypot to attract malicious traffic.
   • DCollecting traffic data over a period of normal operation and analyzing it to identify typical patterns.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's security policy requires that network traffic logs be retained for at least one year to support incident investigations. The logs are currently stored on a local server with limited disk space. What is the best practice to meet this requirement?

   • AForward logs to a centralized log management system with archival storage.
   • BKeep logs only for active incidents and delete the rest after 30 days.
   • CReduce the log verbosity to save space and keep logs for one year.
   • DStore logs in a compressed format on the local server and delete logs older than one year.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary function of a network traffic monitoring tool like tcpdump?

   • ATo block malicious IP addresses at the firewall.
   • BTo capture packets from the network interface and save them to a file for later analysis.
   • CTo generate network traffic for load testing.
   • DTo perform vulnerability scanning of network services.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes how network traffic monitoring contributes to network security?

   • AIt automatically patches vulnerabilities in network devices and servers.
   • BIt provides visibility into network activity, enabling detection of suspicious behavior and supporting incident response.
   • CIt prevents all unauthorized access by enforcing strict access control lists.
   • DIt eliminates the need for security information and event management (SIEM) systems.
   Reveal Solution Discussion Select an answer first