Network Traffic Monitoring ECSS Practice Questions (Page 9)

Questions 41–43

1. 41expert · medium

   A network analyst is using Wireshark to analyze a capture and needs to filter for all HTTP requests from a specific internal IP address to any external IP. Which display filter should the analyst use?

   • Ahttp && ip.dst == 192.168.1.10
   • Btcp.port == 80 && ip.src == 192.168.1.10
   • Chttp && ip.src == 192.168.1.10
   • Dip.src == 192.168.1.10 && tcp.port == 80
   Reveal Solution Discussion Select an answer first
2. 42expert · medium

   A security analyst is investigating a potential data exfiltration. The monitoring system shows a workstation sending a large amount of data to an external IP on port 443 during off-hours. The traffic is encrypted, and the analyst cannot inspect the payload. The analyst needs to determine if this is malicious. Which approach would be most effective?

   • ABlock the destination IP immediately to prevent further data loss
   • BCompare the traffic volume and destination to the workstation's baseline and check threat intelligence for the destination IP
   • CDecrypt the traffic using the workstation's private key
   • DIgnore the traffic because it is encrypted and cannot be analyzed
   Reveal Solution Discussion Select an answer first
3. 43application · medium

   An analyst is examining a packet capture and sees a series of DNS queries for random subdomains under a legitimate domain, each with a different IP address in the response. The queries occur every few seconds. What should the analyst suspect?

   • AA misconfigured DNS server that is failing to resolve queries.
   • BNormal DNS resolution for a content delivery network (CDN).
   • CA DNS cache poisoning attack.
   • DDNS tunneling, where data is exfiltrated or command-and-control traffic is hidden in DNS queries.
   Reveal Solution Discussion Select an answer first