Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A network administrator has a baseline that shows normal web traffic is 80% HTTPS and 20% HTTP. Recently, the administrator notices that HTTP traffic has increased to 60% of total web traffic. The administrator suspects a misconfigured application. What is the most appropriate first step?

   • ABlock all HTTP traffic to force applications to use HTTPS.
   • BUpdate the baseline to reflect the new protocol distribution.
   • CIgnore the change because protocol distribution can vary.
   • DCompare the current protocol distribution to the baseline and investigate which applications are using HTTP.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network analyst is comparing current traffic to the baseline and notices that the packet rate has doubled, but the bandwidth usage is unchanged. What is the most likely explanation?

   • AThe baseline was recorded incorrectly, so the comparison is invalid.
   • BThe average packet size has decreased, meaning more packets are needed to carry the same amount of data.
   • CThe protocol distribution has shifted from TCP to UDP, which uses smaller packets.
   • DThe network is experiencing a denial-of-service attack that floods the network with large packets.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is deploying an intrusion detection system. They need to detect a known worm that has a fixed signature, but they also want to detect new, unknown worms that may exhibit similar behavior. The team has limited resources and must choose a detection approach. What is the best strategy?

   • AUse only behavioral signatures to detect any scanning activity.
   • BUse only static signatures to minimize false positives.
   • CUse both static signatures for the known worm and behavioral signatures for anomalous scanning behavior.
   • DUse static signatures for the known worm and ignore unknown worms.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How are signatures typically created from baseline data?

   • ABy copying signatures from other organizations without modification
   • BBy analyzing baseline traffic to identify common patterns and then defining signatures for known threats or deviations
   • CBy randomly generating strings of characters
   • DBy encrypting the baseline data and using the ciphertext as a signature
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator is setting up a baseline for a new branch office. The office has just been established and will have 20 employees starting next week. There is no historical traffic data. What should the administrator do to establish a baseline?

   • ACapture traffic for one day during the first week of operation.
   • BWait until the office is operational, then capture traffic for a representative period, such as two weeks.
   • CCreate a baseline based on the expected number of employees and typical applications.
   • DUse the baseline from the headquarters office, since it is the same company.
   Reveal Solution Discussion Select an answer first