Baseline Traffic Analysis and Signature Identification NDE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How do network signatures help in detecting anomalies?

   • ABy matching traffic against known patterns of malicious or unusual activity
   • BBy blocking all traffic from unknown IP addresses
   • CBy reducing the volume of traffic on the network
   • DBy encrypting all traffic to prevent eavesdropping
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which metric is commonly used to characterize baseline network traffic?

   • ADisk storage capacity
   • BCPU temperature of endpoints
   • CNumber of installed applications
   • DBandwidth utilization
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which statement correctly describes a behavioral signature?

   • AIt identifies anomalies based on deviations from established behavioral patterns
   • BIt is a signature that never changes over time
   • CIt is a signature that only works with encrypted traffic
   • DIt is a fixed string of bytes that always indicates an attack
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a recommended practice when establishing a network traffic baseline?

   • AUse only aggregated flow data from the core router
   • BRecord traffic only when a security incident is suspected
   • CCapture traffic over a duration that covers typical usage patterns, such as a full business cycle
   • DRecord traffic for a short period during a holiday to minimize data volume
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is reviewing network traffic and notices that a server that normally sends 10 MB of data per day has suddenly sent 2 GB in one hour. The analyst checks the baseline and confirms this is a significant deviation. What should the analyst do next?

   • AUpdate the baseline to include the new higher data transfer volume.
   • BImmediately disconnect the server from the network.
   • CIgnore the deviation because the baseline is only an average.
   • DInvestigate the cause of the deviation to determine if it is benign or malicious.
   Reveal Solution Discussion Select an answer first