Network Traffic Monitoring and Analysis CND Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of establishing a network traffic baseline?

   • ATo provide a backup of all network configuration files for disaster recovery.
   • BTo define what normal network behavior looks like so that deviations can be detected.
   • CTo encrypt all data transmitted across the network to ensure confidentiality.
   • DTo replace the need for firewall rules by automatically blocking all suspicious traffic.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network defender notices a sudden spike in outbound traffic from a single workstation to a known file-sharing site. The workstation is used for accounting and has no business need for that site. Which tool and technique would provide the most immediate evidence to confirm whether the traffic is malicious or just a user violation?

   • ADisable the workstation's network access immediately and then interview the user.
   • BReview NetFlow records for the workstation to see the total bytes transferred and the destination IP.
   • CRun a packet capture on the workstation's switch port and inspect the payloads for data exfiltration patterns.
   • DCheck the firewall logs for the workstation's outbound connections to the file-sharing site.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which tool is specifically designed to capture and analyze individual network packets in real time?

   • AMetasploit
   • BOpenVAS
   • CWireshark
   • DNmap
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When analyzing a packet capture, what does a large number of TCP SYN packets sent to a single host from many different source IP addresses typically indicate?

   • AA DNS cache poisoning attempt.
   • BA SYN flood attack attempting to exhaust the target's connection resources.
   • CA misconfigured router causing packet loss.
   • DNormal network traffic during a routine backup.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An intrusion detection system (IDS) alerts on a suspicious connection from an internal host to a known malicious IP. The analyst wants to confirm whether any data was exfiltrated. Which data source would provide the most definitive evidence?

   • AFirewall logs showing the source and destination IPs and ports.
   • BFull packet capture of the session, if available, to inspect the payloads.
   • CThe IDS alert itself, which includes the signature name.
   • DNetFlow records showing the duration and byte count of the connection.
   Reveal Solution Discussion Select an answer first