Network Traffic Monitoring and Analysis CND Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A network administrator notices that a server that normally sends 2 Mbps of traffic is now sending 50 Mbps to a single external IP address. The traffic started at 2:00 AM. What is the most likely explanation and the best next step?

   • AThe server may be compromised and part of a data exfiltration or botnet activity; investigate the destination IP and capture packets.
   • BThe server is likely performing a legitimate backup; check the backup schedule.
   • CThe network is experiencing a broadcast storm; reboot the switch.
   • DThe server is running a scheduled update; wait for it to finish.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following traffic patterns is most likely to indicate a security incident?

   • APeriodic DNS queries to a known legitimate DNS server.
   • BA steady increase in traffic during business hours.
   • CLow volume of traffic during off-peak hours.
   • DA sudden spike in outbound traffic from an internal host to an external IP address at an unusual time.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A network defender notices a workstation generating continuous outbound TLS connections to a single external IP at odd hours. The connections are small but frequent. To confirm whether this is malicious, the defender needs to see the actual payloads exchanged. Which approach should be used?

   • AReview the firewall logs for the workstation's outbound connections.
   • BUse sFlow sampling on the router to collect a statistical sample of the traffic.
   • CDeploy a packet capture sensor on the workstation's VLAN and capture full packets to a file for analysis.
   • DEnable NetFlow export on the switch and analyze flow records for the workstation's IP.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A network defender needs to analyze a specific application's performance issue. The application uses a proprietary protocol on a non-standard port. Which combination of tools would be most effective for this analysis?

   • AUse a packet capture tool like Wireshark to capture traffic on the specific port and analyze the protocol's behavior.
   • BUse SNMP to check interface errors on the switch port.
   • CUse NetFlow data to see the volume of traffic on that port.
   • DUse a network scanner like Nmap to identify the port and service.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the purpose of using a promiscuous mode when capturing network packets?

   • ATo filter out malicious packets before they reach the host.
   • BTo capture all packets on the network segment, not just those addressed to the capturing host.
   • CTo encrypt the captured packets to protect their confidentiality.
   • DTo increase the speed of packet capture by compressing data.
   Reveal Solution Discussion Select an answer first