Network Traffic Monitoring ECSS Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which tool is commonly used to capture and interactively analyze network packets?

   • ANmap
   • BMetasploit
   • CWireshark
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of configuring alerts in a network monitoring system?

   • ATo automatically block all suspicious traffic without human intervention
   • BTo replace the need for regular log reviews
   • CTo notify administrators of potential security incidents in a timely manner
   • DTo encrypt alert data in transit
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is monitoring network traffic and notices that a workstation is sending large amounts of data to an external IP address on port 443 during off-hours. The traffic volume is significantly higher than the workstation's normal behavior. The analyst needs to determine if this is a security threat. Which action should the analyst take first?

   • ABlock the external IP address at the firewall immediately
   • BIgnore the traffic because it is encrypted on port 443 and cannot be analyzed
   • CCompare the traffic pattern to the workstation's baseline and check if the destination is a known service
   • DDisconnect the workstation from the network to contain the potential threat
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During protocol analysis, which layer of the OSI model would you examine to identify the source and destination IP addresses?

   • AData Link layer
   • BTransport layer
   • CNetwork layer
   • DApplication layer
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network operations team wants to be notified immediately when a specific server's outbound traffic volume exceeds a threshold, but they do not want to be overwhelmed by alerts during normal fluctuations. What should they configure?

   • AA daily report that lists the top talkers by volume, emailed to the team every morning.
   • BA packet capture on the server's port that saves all traffic to a file for later analysis.
   • CAn alert that triggers on any TCP SYN packet sent to the server, regardless of volume.
   • DA NetFlow-based alert that triggers when the server's outbound byte count exceeds 1 GB in a 5-minute window, with a cooldown period of 15 minutes.
   Reveal Solution Discussion Select an answer first