Network Traffic Monitoring ECSS Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An analyst is investigating a potential data exfiltration incident. The packet capture shows encrypted TLS traffic to an external IP, but the analyst cannot decrypt it. However, the analyst notices that the TLS handshake includes a Server Name Indication (SNI) field with a domain name that is not related to the company's business. What should the analyst do?

   • AAttempt to decrypt the traffic by brute-forcing the TLS key.
   • BBlock the external IP immediately.
   • CIgnore the traffic because it is encrypted and cannot be analyzed.
   • DUse the SNI domain as an indicator and investigate the domain's reputation and any other traffic to that domain.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A SOC team is overwhelmed by alerts from the network monitoring system. Most alerts are false positives. The team wants to improve the signal-to-noise ratio without missing real threats. Which strategy would be most effective?

   • ATune alert rules based on historical false-positive data and implement alert aggregation
   • BAdd more alert rules to cover more potential threats
   • CIncrease the severity level of all alerts to ensure they are noticed
   • DDisable all alerts and rely on manual log review
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst is reviewing a packet capture and sees a series of ARP requests from one MAC address claiming to be the gateway IP. The requests are broadcast to all hosts. What should the analyst suspect?

   • AA DHCP starvation attack.
   • BA normal ARP request from a host looking for the gateway's MAC address.
   • CA MAC flooding attack on the switch.
   • DARP spoofing, where an attacker is trying to intercept traffic by impersonating the gateway.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of network traffic monitoring in a network defense strategy?

   • ATo block all incoming and outgoing traffic automatically
   • BTo observe and analyze network activity for security and operational insights
   • CTo replace the need for antivirus software on endpoints
   • DTo encrypt all data transmitted across the network
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst is reviewing a packet capture and notices a large number of TCP SYN packets sent to a single internal server from many different source IP addresses, but no corresponding SYN-ACK replies. The analyst wants to confirm whether this is a SYN flood attack. Which additional observation would most strongly support that conclusion?

   • AThe source IP addresses are spoofed and the SYN packets are arriving at a rate far above the server's normal connection rate
   • BThe capture shows a mix of TCP and UDP traffic to the server
   • CThe SYN packets are all coming from the same internal subnet
   • DThe destination server is responding with RST packets to each SYN
   Reveal Solution Discussion Select an answer first