Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A network analyst has completed a packet capture and identified a series of anomalous TCP connections that may indicate a data exfiltration attempt. The analyst needs to document the findings for a security incident report. What is the most important information to include in the report?

   • AA summary of the anomalous connections, including source/destination IPs, ports, timestamps, and the nature of the anomaly.
   • BThe network topology and device configurations.
   • CThe names of the tools used for the capture and analysis.
   • DThe full packet capture file and the raw packet data.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of the Domain Name System (DNS) in network communication?

   • ARouting packets across multiple networks based on IP addresses
   • BTranslating human-readable domain names into IP addresses
   • CEncrypting data transmitted between web browsers and servers
   • DProviding reliable, ordered delivery of application data
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst sees a TCP session where the client sends a SYN packet, the server responds with a SYN-ACK, but the client never sends the final ACK. The server retransmits the SYN-ACK several times. What is the most likely explanation?

   • AA half-open connection, possibly due to a SYN flood or a client that is not completing the handshake
   • BA normal TCP keep-alive mechanism
   • CThe server is using TCP Fast Open
   • DThe client is using a different TCP stack that does not send ACKs
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   An analyst needs to capture traffic on a busy interface but wants to exclude all traffic to and from a backup server (192.168.1.50) to reduce the capture size. Which tcpdump capture filter should be used?

   • A! host 192.168.1.50 and port 80
   • Bnot src 192.168.1.50
   • Cnot host 192.168.1.50
   • Dhost not 192.168.1.50
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A network administrator is responsible for a 1 Gbps link that is frequently congested. The administrator needs to identify the top bandwidth consumers and produce a monthly report. The administrator has limited budget and cannot deploy new hardware. Which approach is the most practical?

   • AManually review router interface counters daily.
   • BEnable NetFlow on the existing routers and use a flow collector to aggregate data.
   • CUse Wireshark to capture traffic continuously on the link.
   • DDeploy a dedicated packet capture appliance on the link.
   Reveal Solution Discussion Select an answer first