Network Traffic Monitoring and Analysis CND Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which flow-based monitoring protocol is commonly used to export traffic statistics from network devices to a collector?

   • AHTTP
   • BICMP
   • CSNMP
   • DNetFlow
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network administrator wants to monitor traffic patterns across a large campus network without storing full packet captures due to storage constraints. The goal is to detect sudden increases in traffic to a specific server. Which technology is most appropriate?

   • AUse a protocol analyzer in promiscuous mode on a single workstation.
   • BInstall a host-based intrusion detection system on the server.
   • CEnable NetFlow on the core routers and analyze flow records for the server's IP.
   • DDeploy a network TAP and capture all packets to a central storage array.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is an example of correlating traffic data with a security event?

   • AConfiguring a router to use NetFlow for bandwidth monitoring.
   • BUsing a packet capture to measure network latency.
   • CMatching a firewall alert about a port scan with NetFlow records showing a spike in connections to that port from the same source IP.
   • DReviewing firewall logs to check for configuration errors.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company's security team wants to detect anomalies in their network traffic. They have been collecting NetFlow data for three months. What is the most effective first step to establish a baseline for anomaly detection?

   • ADeploy an intrusion detection system to alert on known attack signatures.
   • BAnalyze the NetFlow data to determine average traffic volumes, protocol usage, and peak hours over the three-month period.
   • CConfigure the firewall to block all traffic that is not explicitly allowed.
   • DEnable logging on all network devices and store the logs for one year.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A network administrator is using NetFlow to monitor traffic and notices that a particular internal host is communicating with an external IP on port 53 (DNS) but the packet sizes are consistently large (e.g., 1400 bytes). This is unusual because DNS queries are typically small. What does this suggest?

   • AThe host is experiencing a DNS cache poisoning attack.
   • BThe host is performing a DNS zone transfer.
   • CThe host is tunneling data through DNS queries.
   • DThe host is using a public DNS resolver for normal resolution.
   Reveal Solution Discussion Select an answer first