Network Traffic Monitoring ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network administrator is setting up continuous monitoring on a busy production link. The monitoring tool can capture full packets, but the administrator is concerned about CPU load on the switch and storage consumption. What is the most effective optimization strategy?

   • ADisable monitoring during peak hours to reduce impact.
   • BCapture full packets on the SPAN port and store them for 30 days.
   • CUse sFlow sampling on the switch to export a statistical sample of packets to the collector.
   • DIncrease the SPAN destination port speed to 10 Gbps to handle the traffic.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which characteristic is true of a network tap used for traffic capture?

   • AIt is an inline device that copies traffic while allowing the original to pass through
   • BIt is a firewall rule that redirects traffic to a logging server
   • CIt is a software program installed on a server to capture its own traffic
   • DIt is a wireless access point that intercepts nearby Wi-Fi signals
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the function of port mirroring as a traffic capture technique?

   • AIt duplicates traffic from one or more switch ports to a monitoring port
   • BIt encrypts traffic on a port to protect it from eavesdropping
   • CIt blocks all traffic on a port to prevent unauthorized access
   • DIt splits a single network link into two separate physical links
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which strategy can help minimize the performance impact of network monitoring on production traffic?

   • ACapturing all traffic on all ports at all times
   • BDeploying monitoring agents on every endpoint
   • CUsing passive monitoring techniques like port mirroring
   • DIncreasing the size of the monitoring buffer on the switch
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations center (SOC) is receiving a high volume of alerts from its IDS, many of which are false positives. The SOC team is becoming desensitized to alerts and may miss real threats. The team wants to reduce alert noise while maintaining detection of actual attacks. What is the most effective approach?

   • AIncrease the threshold for all alerts so only the most severe events trigger an alert.
   • BAdd more IDS sensors to increase coverage and generate more alerts.
   • CTune the IDS signatures to suppress known false positives and implement alert correlation rules to group related alerts.
   • DDisable all IDS alerts and rely on manual log review.
   Reveal Solution Discussion Select an answer first