Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is anomaly detection in network monitoring?

   • AThe process of encrypting all network traffic
   • BThe process of identifying traffic patterns that deviate from normal behavior
   • CThe process of blocking all traffic from unknown sources
   • DThe process of compressing packets to reduce bandwidth
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a traffic characteristic used to define a baseline?

   • AHardware serial numbers
   • BUser account names
   • COperating system version
   • DProtocol distribution
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A network administrator is establishing a baseline for a new office that will have seasonal traffic patterns: high volume during the holiday season (November–December) and lower volume the rest of the year. The administrator needs to detect anomalies year-round. What is the best approach?

   • ACreate a single baseline from the first month of operation and use it for the entire year.
   • BUse the highest observed traffic as the baseline to avoid false positives.
   • CDo not create a baseline; rely on static signatures for known threats.
   • DCreate separate baselines for peak and off-peak seasons and compare current traffic to the appropriate baseline.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of comparing current network traffic against a baseline?

   • ATo replace the baseline with the current traffic data
   • BTo calculate the exact number of packets that will be sent tomorrow
   • CTo ensure that all traffic is encrypted
   • DTo identify significant deviations that may indicate issues or attacks
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network administrator has a baseline showing that the office's total outbound bandwidth averages 50 Mbps during business hours. Today, the administrator observes a sustained 200 Mbps outbound bandwidth for 30 minutes. Which step should the administrator take first?

   • AImmediately block all outbound traffic to prevent data exfiltration.
   • BIgnore the deviation because the baseline is only an average.
   • CCompare the current traffic to the baseline and investigate the source of the deviation.
   • DUpdate the baseline to reflect the new higher bandwidth usage.
   Reveal Solution Discussion Select an answer first