An analyst is reviewing a capture and sees a TCP packet with the SYN and FIN flags both set. What does this indicate?

A normal TCP connection that is being established and closed simultaneously

A misconfigured firewall or a network device that is corrupting packets

A packet that is part of a UDP-to-TCP translation

A network administrator is analyzing a capture and sees that a client is using both TCP and UDP to communicate with a server on port 53. The TCP connection is used for a zone transfer, while the UDP traffic is for standard queries. What does this indicate?

A network issue causing UDP packets to be dropped and retransmitted over TCP

Normal DNS behavior, as TCP is used for zone transfers and large responses, while UDP is used for standard queries

A misconfiguration where the server is forcing all clients to use TCP

A DNS tunneling attempt using TCP

EC-CouncilNetwork Defense Essentials

Domain 7Objective 4

Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 6)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

40questions here

8free pages

8concepts

Questions 26–30

26foundation · easy
In Wireshark, which feature allows you to capture only packets that match a specific condition at the time of capture?
Select an answer first
27application · medium
An analyst is reviewing a capture and sees a TCP packet with the SYN and FIN flags both set. What does this indicate?
Select an answer first
28expert · medium
A network administrator is analyzing a capture and sees that a client is using both TCP and UDP to communicate with a server on port 53. The TCP connection is used for a zone transfer, while the UDP traffic is for standard queries. What does this indicate?
Select an answer first
29foundation · easy
Which protocol is connection-oriented and provides reliable, ordered delivery of data between applications?
Select an answer first
30foundation · easy
In Wireshark, which type of filter is used to display only packets that contain a specific protocol after the capture is complete?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 6)

Questions 26–30

In Wireshark, which feature allows you to capture only packets that match a specific condition at the time of capture?

An analyst is reviewing a capture and sees a TCP packet with the SYN and FIN flags both set. What does this indicate?

A network administrator is analyzing a capture and sees that a client is using both TCP and UDP to communicate with a server on port 53. The TCP connection is used for a zone transfer, while the UDP traffic is for standard queries. What does this indicate?

Which protocol is connection-oriented and provides reliable, ordered delivery of data between applications?

In Wireshark, which type of filter is used to display only packets that contain a specific protocol after the capture is complete?

Keep studying — Network Traffic Monitoring