A network administrator needs to capture only HTTP requests and responses exchanged between a specific web server (192.168.10.50) and any client on the 192.168.10.0/24 subnet. The capture should exclude all other traffic to reduce file size. Which tcpdump command should the administrator use?

tcpdump -i eth0 host 192.168.10.50 and port 80

tcpdump -i eth0 tcp and port 80 and not host 192.168.10.50

tcpdump -i eth0 net 192.168.10.0/24 and host 192.168.10.50 and tcp port 80

tcpdump -i eth0 src 192.168.10.50 and dst port 80

A network engineer needs to measure the average throughput of a file transfer session between two servers over a 10-minute period. The engineer has a full packet capture. Which approach provides the most accurate measurement?

Count the number of packets in the capture and divide by 600 seconds

Check the server's network interface statistics for the period

Use Wireshark's IO Graph to plot bytes per second and calculate the average over the session duration

Use the 'Statistics > Endpoints' feature to see total bytes per IP address

A network engineer is troubleshooting a slow application. The packet capture shows that the client's TCP window size is consistently small (e.g., 10 KB) even though the client advertises a large window in the SYN packet. What is the most likely cause?

The application is using UDP instead of TCP

The network is dropping packets, causing the window to collapse

The client is experiencing receive buffer pressure, causing the window to shrink

The server is using TCP window scaling incorrectly

An administrator is using Wireshark to analyze a capture file and needs to see only HTTP requests and responses exchanged between the host 192.168.1.10 and any web server. Which display filter should be applied?

http && ip.addr == 192.168.1.10

tcp.port == 80 && ip.src == 192.168.1.10

EC-CouncilNetwork Defense Essentials

Domain 7Objective 4

Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 5)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

40questions here

8free pages

8concepts

Questions 21–25

21foundation · easy
Which tool or feature is commonly used to measure network bandwidth utilization and identify bottlenecks?
Select an answer first
22application · medium
A network administrator needs to capture only HTTP requests and responses exchanged between a specific web server (192.168.10.50) and any client on the 192.168.10.0/24 subnet. The capture should exclude all other traffic to reduce file size. Which tcpdump command should the administrator use?
Select an answer first
23application · medium
A network engineer needs to measure the average throughput of a file transfer session between two servers over a 10-minute period. The engineer has a full packet capture. Which approach provides the most accurate measurement?
Select an answer first
24expert · hard
A network engineer is troubleshooting a slow application. The packet capture shows that the client's TCP window size is consistently small (e.g., 10 KB) even though the client advertises a large window in the SYN packet. What is the most likely cause?
Select an answer first
25application · medium
An administrator is using Wireshark to analyze a capture file and needs to see only HTTP requests and responses exchanged between the host 192.168.1.10 and any web server. Which display filter should be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.