Network Traffic Monitoring and Analysis CND Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A network team wants to monitor traffic patterns across their entire network without storing full packet captures, due to storage constraints. They need to see top talkers, protocol distribution, and bandwidth usage over time. Which approach best meets these requirements?

   • AEnable syslog logging on all devices and analyze the logs.
   • BUse SNMP polling to collect interface byte counters every 5 minutes.
   • CInstall a packet capture appliance at the internet gateway and store all packets for 30 days.
   • DDeploy NetFlow or sFlow exporters on routers and switches and collect the flow records in a central collector.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team needs to ensure that network traffic logs are tamper-evident to support legal proceedings. Which practice is most important?

   • AStore logs in a centralized location accessible to all administrators.
   • BUse write-once, read-many (WORM) storage or cryptographic hashing to protect log integrity.
   • CRetain logs for at least 90 days.
   • DCompress logs to save space.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A network administrator needs to monitor traffic on a high-speed backbone link where full packet capture is not feasible due to performance constraints. The goal is to get a general overview of traffic flows and bandwidth usage. Which tool or technique is most suitable?

   • AInstall a proxy server to log all HTTP requests.
   • BEnable sFlow sampling on the switch to export sampled flow data.
   • CDeploy a network TAP and use Wireshark for analysis.
   • DUse tcpdump to capture all packets on the link.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is required to retain logs for compliance, but the security team is concerned about the cost of storing large volumes of traffic logs. They want to reduce storage costs while still meeting the retention requirement. What is the most effective approach?

   • AStore all logs in their original format for the full retention period without any summarization.
   • BDelete logs older than 30 days to save storage costs.
   • CStore raw logs for a short period (e.g., 30 days) and store summarized or aggregated logs for the full retention period.
   • DCompress the logs and store them on low-cost storage like tape.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is required by industry regulations to retain network traffic logs for at least one year. They currently store logs on the local disks of each device, which are frequently overwritten. What is the most effective solution to meet the retention requirement?

   • ACentralize log collection to a dedicated log management server with sufficient storage and implement log rotation and archiving.
   • BIncrease the log buffer size on each device to store more logs locally.
   • CDisable logging on devices that generate high volumes of logs to save space.
   • DCompress the logs on each device and store them in a shared folder.
   Reveal Solution Discussion Select an answer first