Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network analyst is using Wireshark to investigate a possible DNS exfiltration. The analyst wants to see only DNS queries that contain the string 'exfil' in the query name, and also wants to see the source IP address of each query. Which display filter should be applied?

   • Aip.src == 192.168.1.0/24 && dns
   • Bdns.flags.response == 0 && dns.qry.name matches "exfil"
   • Cdns.qry.name contains "exfil"
   • Ddns.qry.name == "exfil.example.com"
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In an IPv4 packet header, which field indicates the total length of the IP packet including the header and payload?

   • AHeader Length
   • BIdentification
   • CTotal Length
   • DTime to Live
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A network engineer is measuring the throughput of a link using a packet capture. The capture shows that the link is 90% utilized, but the application is experiencing poor performance. What additional analysis should the engineer perform to identify the bottleneck?

   • ACheck the total number of packets captured
   • BLook at the source and destination MAC addresses
   • CAnalyze TCP retransmissions and duplicate ACKs to detect packet loss
   • DVerify that the capture filter included all traffic
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is reviewing a packet capture and notices a large number of TCP SYN packets sent to a single host from many different source IP addresses, but no SYN-ACK responses are observed. What does this pattern most likely indicate?

   • AA normal TCP handshake process for a high-traffic server.
   • BA misconfigured firewall blocking incoming SYN packets.
   • CA DNS amplification attack using spoofed source addresses.
   • DA SYN flood attack attempting to exhaust the target's connection resources.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which protocol behavior would be considered a deviation from the standard and might indicate malicious activity?

   • AAn HTTP request with a very large payload in the header
   • BA TCP connection that completes the three-way handshake and then transfers data
   • CA DNS response that returns the correct IP address for a queried domain
   • DAn ICMP echo request and reply between two hosts
   Reveal Solution Discussion Select an answer first