Network Traffic Monitoring and Analysis CND Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A network team is establishing a baseline for a new cloud-based application that will be used by employees worldwide. The application's traffic varies significantly by time zone and day of week. What is the most appropriate baselining strategy?

   • AUse a single average baseline for all traffic to simplify monitoring.
   • BCreate separate baselines for different time periods (e.g., business hours vs. off-hours) and for weekdays vs. weekends.
   • CBase the baseline only on the busiest hour of the day to ensure capacity is sufficient.
   • DWait until the application has been in production for a year to establish a baseline.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary goal of anomaly detection in network traffic monitoring?

   • ATo replace the need for antivirus software.
   • BTo block all traffic from unknown IP addresses.
   • CTo identify traffic patterns that deviate from the established baseline.
   • DTo encrypt all traffic to prevent eavesdropping.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A network team is choosing between NetFlow and sFlow for monitoring a high-speed backbone. They need to detect volumetric anomalies and also want to see per-flow details like TCP flags. The backbone carries 10 Gbps of traffic. Which choice is more appropriate and why?

   • AUse NetFlow without sampling to get complete flow records, even if it overwhelms the collector.
   • BUse sFlow because it samples packets at line rate and provides a statistical view of traffic, but it does not provide per-flow TCP flag details.
   • CUse NetFlow because it provides per-flow records with TCP flags and is widely supported, though it may require sampling at very high speeds.
   • DUse sFlow with a high sampling rate to get near-complete flow data, including TCP flags.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security analyst is examining a packet capture and sees a series of TCP packets with the SYN flag set, followed by a RST from the same source IP to different destination ports on the same target. This pattern is characteristic of which activity?

   • AA misconfigured firewall dropping packets.
   • BA normal application connecting to multiple services.
   • CA denial-of-service attack flooding the target with SYN packets.
   • DA TCP SYN scan to identify open ports.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A network administrator is using NetFlow data to investigate a possible data exfiltration. The administrator notices a flow with a large amount of data transferred from an internal server to an external IP during off-hours. Which characteristic of the flow would be most suspicious?

   • AThe flow uses TCP port 443 (HTTPS).
   • BThe flow occurs at 3:00 AM and transfers a large volume of data to an external IP that has no prior history in the baseline.
   • CThe flow has a long duration and consistent byte rate.
   • DThe flow uses a high source port number.
   Reveal Solution Discussion Select an answer first