Network Traffic Monitoring and Analysis CND Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a packet capture analysis, an analyst sees a series of TCP SYN packets sent to a server, followed by SYN-ACK responses, but no final ACK from the client. This pattern repeats thousands of times from different source IP addresses. What does this indicate?

   • AA network latency issue causing clients to time out before completing the handshake.
   • BA normal network scan to identify open ports.
   • CA misconfigured firewall dropping the final ACK packets.
   • DA TCP SYN flood attack attempting to exhaust the server's connection resources.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst needs to investigate a security incident that occurred two weeks ago. The company's logging policy only retains firewall logs for 7 days. What is the most appropriate action to improve the ability to investigate future incidents?

   • ADisable logging on non-critical devices to reduce the volume of logs.
   • BUse a packet capture tool to record all traffic continuously and store the captures for 30 days.
   • CRely on the memory of the network administrator who was on duty during the incident.
   • DIncrease the log retention period to at least 90 days and ensure logs are time-synchronized across all devices.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During routine traffic analysis, a defender notices a large number of TCP SYN packets sent to a single server from many different source IPs, but no completed handshakes. This pattern is consistent with which type of activity?

   • AA legitimate spike in user traffic due to a marketing campaign.
   • BA misconfigured application sending repeated connection requests.
   • CA distributed denial-of-service (DDoS) attack attempting to exhaust server resources.
   • DA normal network scan performed by an internal vulnerability scanner.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is investigating a slow network issue and has a packet capture from the core switch. The capture shows many TCP retransmissions and duplicate ACKs for connections to a database server. What is the most likely cause?

   • AThe database server is overloaded and slow to respond.
   • BA firewall is dropping packets based on application-layer rules.
   • CThe clients are using an outdated TCP stack.
   • DNetwork congestion or packet loss between the clients and the database server.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is reviewing NetFlow data and notices that a single internal host is communicating with a large number of external IP addresses on port 445 (SMB) within a short time frame. The host is a user workstation, not a server. What is the most likely interpretation?

   • AThe user is browsing the internet normally.
   • BThe workstation is backing up to a cloud storage service.
   • CThe workstation is performing a legitimate Windows update.
   • DThe workstation may be infected with malware that is scanning the internet for vulnerable SMB services.
   Reveal Solution Discussion Select an answer first