Network Traffic Monitoring ECSS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network engineer is using tcpdump to capture traffic on a Linux server's interface. The engineer wants to capture only HTTP traffic and save it to a file for later analysis. What command should the engineer use?

   • Atcpdump -i eth0 -c 100 -w http.pcap
   • Btcpdump -i eth0 -n 'udp port 53'
   • Ctcpdump -i eth0 -v -w http.pcap 'tcp port 443'
   • Dtcpdump -i eth0 -w http.pcap 'tcp port 80'
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A small business wants to implement network traffic monitoring to detect intrusions, but they have a limited budget and no dedicated security staff. They need a solution that provides visibility into malicious activity without requiring full-time monitoring. What should they deploy?

   • AAn open-source intrusion detection system (IDS) that analyzes traffic and sends email alerts for suspicious activity.
   • BA commercial SIEM with a dedicated security analyst to monitor alerts 24/7.
   • CA firewall with logging enabled, but no analysis or alerting.
   • DA network tap on the internet link with a packet capture device that stores all traffic for 90 days.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network administrator needs to capture traffic on a critical server's uplink without any downtime. The switch does not support SPAN, but the administrator can schedule a maintenance window. What is the best method to capture the traffic?

   • AUse NetFlow to approximate the traffic without full capture.
   • BUse a hub to connect the server to the network and capture from the hub.
   • CInstall packet capture software on the server itself.
   • DPlace a network tap inline on the server's uplink during the maintenance window.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network administrator is planning to deploy a monitoring solution on a high-throughput network. The administrator needs to capture full packets for forensic analysis but is concerned about the storage requirements. Which strategy would best balance capture completeness and storage usage?

   • ACapture full packets only for traffic to critical servers and use flow data for the rest
   • BUse flow data only and store it for 30 days
   • CCapture full packets on all traffic and store them for 30 days
   • DCapture full packets but only during business hours
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network administrator needs to capture traffic on a segment where the switch does not support port mirroring. The administrator has access to a spare network tap. Which action should the administrator take to capture the traffic?

   • APlace the network tap inline between the two devices on the segment
   • BInstall a packet capture agent on the devices to forward traffic
   • CConnect the tap to the switch's uplink port and configure a SPAN port
   • DUse a hub instead of the tap and connect the monitoring device to the hub
   Reveal Solution Discussion Select an answer first