Network Traffic Monitoring ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing a packet capture and notices a large number of TCP SYN packets sent to a single host from many different source IP addresses, with no corresponding SYN-ACK replies. What should the analyst conclude?

   • AThe host is performing a port scan to discover open services.
   • BThe host is the target of a SYN flood attack, potentially causing resource exhaustion.
   • CThe host is experiencing a broadcast storm caused by a loop in the network.
   • DThe traffic is normal TCP retransmissions due to network congestion.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which command-line tool is specifically designed to capture packets and write them to a file for later analysis?

   • Aping
   • Bnetstat
   • Ctraceroute
   • Dtcpdump
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which network traffic pattern would be considered an anomaly that may indicate a security threat?

   • AA printer sending a small amount of data to a known print server
   • BA server receiving regular HTTP requests from many clients during business hours
   • CA user checking email via a standard email client
   • DA workstation sending a large volume of data to an external IP address at 3:00 AM
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A network monitoring system flags a sudden increase in DNS queries from a single internal host to many different external domains. The host is a file server that normally makes few DNS queries. The analyst needs to determine if this is a security threat. Which additional data would be most useful?

   • AThe IP address of the DNS server being used
   • BThe TTL values in the DNS responses
   • CThe content of the DNS queries, such as the domain names being queried
   • DThe MAC address of the internal host
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network analyst is reviewing a packet capture and sees a TCP connection with the SYN flag set, followed by a RST flag from the destination. The source then sends another SYN to the same destination. This pattern repeats. What does this pattern most likely indicate?

   • AThe source is performing a SYN flood attack
   • BThe destination is experiencing a denial-of-service attack
   • CThe destination is rejecting connection attempts, possibly due to a firewall rule or closed port
   • DThe source and destination are negotiating a new TCP feature
   Reveal Solution Discussion Select an answer first