Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A network admin is comparing current traffic to the baseline and notices that the protocol distribution has shifted significantly: UDP traffic has increased from 10% to 50% of total packets, while TCP traffic has decreased. Bandwidth is unchanged. What is the most likely explanation?

   • AThe network is under a DNS amplification attack.
   • BThe network is experiencing a TCP SYN flood attack.
   • CThe baseline was recorded incorrectly, so the comparison is invalid.
   • DA new application that uses UDP, such as VoIP or video streaming, has been deployed.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network admin has a baseline that shows normal HTTP traffic is 20% of total bandwidth, with a consistent pattern of small requests and large responses. Today, HTTP traffic is 60% of bandwidth, and the pattern shows large requests and small responses. The admin must decide whether to investigate or update the baseline. What is the best course of action?

   • ABlock all HTTP traffic to prevent a potential attack.
   • BIgnore the deviation because HTTP traffic is often unpredictable.
   • CInvestigate the traffic because the change in pattern, not just volume, indicates a potential anomaly.
   • DUpdate the baseline to reflect the new traffic pattern, since HTTP traffic is naturally variable.
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A network administrator is creating a baseline for a small office network. The administrator has captured traffic for two weeks and now needs to summarize the data into a set of metrics. Which combination of metrics is most useful for characterizing the baseline?

   • AIP address assignments, DNS server settings, and default gateway.
   • BBandwidth usage, packet rates, and protocol distribution.
   • CNumber of users, office location, and business hours.
   • DFirewall rule count, antivirus version, and patch level.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A network monitoring system uses a baseline to detect anomalies. The baseline shows that the average packet size is 500 bytes. Today, the average packet size is 1,500 bytes, but the packet rate has decreased proportionally, so the bandwidth is unchanged. The admin must decide whether this is an anomaly. What is the best decision?

   • AIgnore the change because bandwidth is unchanged, so there is no issue.
   • BBlock all traffic with large packets to prevent a potential attack.
   • CInvestigate the change because the packet size distribution is a key metric that may indicate a different application or attack.
   • DUpdate the baseline to reflect the new packet size.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A network analyst is monitoring a network that has a baseline showing normal traffic is 70% TCP, 20% UDP, and 10% ICMP. Suddenly, the analyst observes that ICMP traffic has increased to 50% of total traffic. The analyst suspects a network scanning activity. What is the most appropriate action?

   • ABlock all ICMP traffic to prevent scanning.
   • BCompare the current ICMP traffic to the baseline and investigate the source of the increase.
   • CUpdate the baseline to reflect the new ICMP percentage.
   • DIgnore the change because ICMP is not a security risk.
   Reveal Solution Discussion Select an answer first