Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a TCP connection, which sequence of flags is used during the three-way handshake to establish a connection?

   • ASYN, ACK, SYN-ACK
   • BACK, FIN, ACK
   • CSYN, SYN-ACK, ACK
   • DFIN, ACK, FIN-ACK
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which command-line tool is commonly used to capture packets on a specified network interface in Linux?

   • Anetstat
   • Bping
   • Ctcpdump
   • Dnslookup
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst needs to capture only HTTP traffic on a network interface, but the network uses a non-standard port for HTTP (port 8080). Which capture filter should be used in tcpdump?

   • Atcp port 8080
   • Budp port 8080
   • Cport 80 or port 8080
   • Dhttp
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a potential data exfiltration. The capture shows a client sending large amounts of data to an external server on port 53 using UDP. The DNS queries are for random subdomains under a domain controlled by the attacker. What is the most likely technique being used?

   • ADNS tunneling, where data is encoded in DNS queries and responses
   • BA DNS amplification attack
   • CNormal DNS caching behavior
   • DA zone transfer attempt
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which Wireshark display filter expression would show only packets sent to or from IP address 192.168.1.10?

   • Aip.src == 192.168.1.10
   • Bip.addr == 192.168.1.10
   • Cip.dst == 192.168.1.10
   • Dtcp.port == 192.168.1.10
   Reveal Solution Discussion Select an answer first