Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of documenting network traffic monitoring findings?

   • ATo automatically block malicious traffic
   • BTo increase network speed
   • CTo provide a record for further investigation and compliance
   • DTo replace the need for firewalls
   Reveal Solution Discussion Select an answer first
2. 32expert · hard · select all that apply

   An analyst is reviewing a packet capture and notices a TCP session with the following characteristics: the client sends a SYN, the server responds with SYN-ACK, the client sends ACK, then immediately sends a RST. This pattern repeats for multiple ports on the same server. Select all that apply: What could this pattern indicate?

   • AA misconfigured application that closes connections immediately
   • BA normal TCP keep-alive probe
   • CA half-open scan
   • DA TCP connect scan
   Check answers Discussion Select an answer first
4. 33application · medium

   An analyst is reviewing a packet capture and sees a TCP connection where the client sends a SYN packet, the server responds with SYN-ACK, but the client never sends the final ACK. Instead, the client sends another SYN packet. This pattern repeats several times. What is the most likely explanation?

   • AThe client is using a TCP option that the server does not support.
   • BThe client is experiencing a network issue that prevents the final ACK from being delivered.
   • CThe server is not responding correctly to the SYN packet.
   • DThe client is attempting a TCP handshake spoofing attack.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In a TCP segment, which field identifies the application or service on the source device?

   • ASource Port
   • BWindow Size
   • CSequence Number
   • DDestination Port
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which behavior in a network traffic capture would most likely indicate anomalous activity?

   • AA TCP connection established with the three-way handshake followed by data transfer
   • BA client and server exchanging HTTP requests and responses on port 80
   • CA single host sending a large number of SYN packets to many different ports on the same target
   • DA DNS query from a workstation to a configured DNS server
   Reveal Solution Discussion Select an answer first