Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which metric is used to measure the amount of data transferred over a network in a given time period?

   • APacket loss
   • BJitter
   • CLatency
   • DThroughput
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices in a packet capture that a single client is sending TCP packets with the SYN flag set to many different destination IP addresses on port 443, and none of the destinations respond. What should the analyst suspect?

   • ANormal client behavior when loading a webpage with multiple resources
   • BA port scan of a single host
   • CA SYN flood attack originating from the client
   • DA network sweep looking for hosts with a service listening on port 443
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After analyzing a packet capture, an analyst needs to document the findings for a compliance report. Which information is most important to include?

   • AThe name of the analyst who captured the traffic
   • BThe full payload of every packet captured
   • CThe source and destination IP addresses, ports, protocols, and timestamps of suspicious traffic
   • DThe version of Wireshark used
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A network analyst is monitoring a server that hosts a critical application. The analyst notices that the server is receiving a high volume of TCP SYN packets from a single external IP, but the server is not responding with SYN-ACK. The analyst also sees that the server's CPU usage is low. What is the most likely cause?

   • AThe external IP is spoofed and the SYN packets are part of a reflection attack.
   • BThe server is experiencing a SYN flood and is unable to respond due to resource exhaustion.
   • CThe server's firewall is dropping the SYN packets before they reach the application.
   • DThe server's TCP stack is misconfigured and cannot handle incoming connections.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network administrator is troubleshooting slow performance on a critical link. The administrator captures traffic for 10 minutes and sees an average throughput of 85 Mbps on a 100 Mbps link. The capture also shows that the link is saturated during peak bursts. What is the most appropriate next step to identify the cause?

   • AAnalyze the top talkers by IP and protocol to identify which applications or hosts are consuming the most bandwidth.
   • BIncrease the capture buffer size to avoid packet loss during the next capture.
   • CDisable the capture filter to ensure all traffic is captured.
   • DUpgrade the link to 1 Gbps to eliminate the bottleneck.
   Reveal Solution Discussion Select an answer first