Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A network admin has a baseline that shows normal DNS traffic is about 5% of total bandwidth. Today, DNS traffic is 40% of total bandwidth. The admin suspects a DNS amplification attack. What is the first step the admin should take?

   • AIgnore the deviation because DNS traffic is often bursty.
   • BUpdate the baseline to reflect the new DNS traffic level.
   • CBlock all DNS traffic to stop the potential attack.
   • DVerify the source of the DNS traffic by examining the destination IPs and packet sizes.
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A network administrator is explaining the concept of a baseline to a new team member. The administrator wants to emphasize the importance of establishing a baseline before deploying an intrusion detection system. Which statement best explains why a baseline is necessary?

   • AA baseline ensures the IDS will not generate any false positives.
   • BA baseline is used to set the IDS's logging level.
   • CA baseline is required to configure the IDS's static signatures.
   • DA baseline provides a reference for normal behavior, allowing the IDS to detect deviations.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a traffic signature in the context of network monitoring?

   • AThe IP address of the network gateway
   • BA cryptographic hash of all network packets
   • CThe digital certificate used to encrypt traffic
   • DA unique pattern in traffic that identifies a specific application, protocol, or anomaly
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Why is it important to establish a baseline of normal network traffic?

   • ATo ensure all traffic is encrypted before transmission
   • BTo replace the need for real-time monitoring tools
   • CTo reduce the overall bandwidth consumption of the network
   • DTo provide a reference for detecting abnormal behavior and potential security incidents
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a static signature in network traffic analysis?

   • AA fixed pattern, such as a specific byte sequence, that identifies known traffic
   • BA signature based on the statistical deviation from a baseline
   • CA pattern that adapts to changing network conditions
   • DA signature that is updated automatically every hour
   Reveal Solution Discussion Select an answer first