Network Traffic Monitoring ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst notices that a server is sending a large amount of traffic to a single external IP on port 53 (DNS) during non-business hours. The traffic is not typical for the server. What should the analyst do?

   • ACapture and analyze the traffic to determine if it is DNS tunneling or a legitimate DNS service.
   • BBlock all outbound DNS traffic from the server to the external IP.
   • CRebuild the server from a known-good image.
   • DIgnore the traffic because DNS is a standard protocol.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network team is planning to deploy a network monitoring solution that will capture traffic from a 10 Gbps backbone link. They are concerned about the monitoring server's ability to keep up with the traffic volume. What should they do to ensure the monitoring server does not drop packets?

   • AEnable NetFlow on the switch and export flow records to the monitoring server.
   • BUse a network tap with a dedicated monitoring port and a capture server with a 10 Gbps NIC and sufficient disk I/O.
   • CCapture traffic only during off-peak hours to reduce the load.
   • DUse SPAN to mirror the link to a single 1 Gbps monitoring port.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of anomaly detection in network traffic monitoring?

   • ATo encrypt traffic to prevent eavesdropping
   • BTo identify traffic patterns that deviate from normal behavior
   • CTo block all traffic that does not match a signature
   • DTo replace the need for firewall rules
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is reviewing traffic logs and notices that a workstation is communicating with an external IP address on port 443 at regular 5-minute intervals, each session transferring about 200 KB. The workstation's user has no known business need for this communication. What should the analyst do first?

   • ABlock the external IP address immediately at the firewall.
   • BIgnore the traffic because port 443 is encrypted and cannot be analyzed.
   • CInvestigate the external IP address and correlate the traffic with other hosts to determine if it is malicious.
   • DRebuild the workstation from a known-good image.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A network monitoring system has detected a new anomaly: a server that normally communicates with a few known IPs is now sending traffic to a wide range of IPs on port 445 (SMB). The traffic volume is moderate, and the server's CPU usage is high. The security team is unsure if this is a worm spreading or a legitimate backup process. What should they do first?

   • AImmediately disconnect the server from the network to contain a potential worm.
   • BBlock all outbound SMB traffic from the server.
   • CCorrelate the traffic with the server's scheduled tasks and check if any backup or update process is scheduled to run at that time.
   • DIgnore the traffic because SMB is a legitimate protocol.
   Reveal Solution Discussion Select an answer first