Network Traffic Monitoring ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator needs to capture traffic between two core switches for security analysis. The switches support port mirroring, but the administrator is concerned about the impact on the production traffic flowing through the switches. Which approach best addresses the concern while still providing the needed capture?

   • AConfigure a network tap between the two switches and connect the tap's monitor port to the analysis device
   • BInstall a software agent on the analysis device and enable remote packet capture across the network
   • CUse a packet capture tool on the analysis device and connect it to a management port on one switch
   • DEnable port mirroring on both switches and send the mirrored traffic to a single analysis port
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A security analyst is examining a packet capture and sees a series of TCP packets with the PSH and ACK flags set, carrying small payloads, sent at regular intervals to an external IP. The traffic is not typical for the internal host. The analyst suspects data exfiltration. Which additional analysis would best confirm the suspicion?

   • ACheck if the payloads contain sensitive data patterns, such as credit card numbers or keywords
   • BCheck the TTL values to determine the operating system of the destination
   • CCheck the TCP window size to infer the destination's buffer size
   • DCheck the sequence numbers to see if the packets are in order
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which element is typically included in a network traffic monitoring report?

   • AThe full content of every captured packet
   • BThe encryption keys used for secure communications
   • CThe password hashes of all network users
   • DSummary of traffic volume and top talkers
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is monitoring network traffic and sees a sudden spike in outbound traffic from a single workstation to multiple external IPs on port 80. The workstation normally has low traffic. What should the analyst do?

   • AInvestigate the workstation for possible malware infection or data exfiltration.
   • BRebuild the workstation immediately.
   • CIgnore the traffic because port 80 is commonly used for web browsing.
   • DBlock all outbound port 80 traffic from the workstation.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common optimization technique to reduce the load on a network monitoring system?

   • AUsing a single monitoring point for the entire network
   • BFiltering captured traffic to only relevant protocols or IP ranges
   • CCapturing all traffic without any filters to ensure completeness
   • DDisabling logging on the monitoring server
   Reveal Solution Discussion Select an answer first