Network Traffic Monitoring ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best describes network traffic monitoring in the context of network defense?

   • AIt is a passive activity that collects data for analysis without altering traffic flow
   • BIt is an active control that modifies packets to enforce security policies
   • CIt is primarily focused on blocking malware downloads
   • DIt is only used after a security breach has been detected
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network administrator is deploying a monitoring solution that will analyze traffic from multiple remote sites. The administrator wants to minimize bandwidth usage between the sites and the central monitoring server. What should the administrator do?

   • AUse a VPN tunnel to securely transmit all traffic to the central server.
   • BSend all raw packet captures from each site to the central server for analysis.
   • CDeploy distributed collectors at each site that pre-process and send only summarized alerts and metadata to the central server.
   • DDisable monitoring at remote sites to save bandwidth.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team wants to generate a weekly report that summarizes the top sources of malicious traffic and the number of alerts triggered per source. They have a SIEM that collects logs from firewalls and IDS. What is the best way to produce this report?

   • AExport raw packet captures from the network tap and analyze them with Wireshark.
   • BCreate a dashboard in the SIEM that aggregates alerts by source IP and schedule a weekly email of the dashboard.
   • CManually review firewall logs each week and compile a spreadsheet.
   • DConfigure the IDS to send an alert every time a malicious packet is detected.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC manager wants to reduce alert fatigue by ensuring that alerts are meaningful and actionable. The monitoring tool currently generates an alert for every failed login attempt. Which configuration change would best reduce noise while maintaining security visibility?

   • ADisable alerts for failed logins and rely on periodic reports
   • BIncrease the alert threshold to trigger only after multiple failed attempts from the same source within a short time
   • CSend alerts only to the IT helpdesk instead of the SOC
   • DIncrease the severity level of all failed login alerts
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which protocol analysis observation would most likely indicate a potential port scan?

   • AA single TCP connection to a web server on port 443
   • BAn ICMP echo reply from a host
   • CA series of TCP SYN packets sent to multiple different ports from the same source IP
   • DA DNS query for a legitimate domain name
   Reveal Solution Discussion Select an answer first