Monitoring and Analyzing Network Protocol Traffic NDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   While reviewing a Wireshark capture, an analyst sees a TCP session with the following packets: SYN, SYN-ACK, ACK, then a series of packets with the PSH and ACK flags, followed by a FIN, ACK, ACK. What does this sequence indicate?

   • AA port scan attempt using TCP connect scanning
   • BA normal three-way handshake followed by data transfer and a graceful teardown
   • CA half-open connection that never completed the handshake
   • DA TCP reset attack that terminated the session abruptly
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   While analyzing a packet capture, a security analyst notices a TCP session with a three-way handshake followed by a large data transfer, but the session ends with a RST packet instead of a FIN. The source IP is an internal workstation and the destination is an external server. What should the analyst conclude from this pattern?

   • AThe connection was likely terminated abruptly, possibly due to an error, timeout, or an intrusion prevention system resetting the session.
   • BThe external server is down and the RST is a response to a SYN packet.
   • CThe workstation is infected with malware that always sends RST packets after data exfiltration.
   • DThe session completed normally and the RST is a standard way to close idle connections.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which element is typically included in a network traffic monitoring report?

   • AThe personal passwords of users
   • BThe full contents of every captured packet
   • CSummary of observed protocols and their volumes
   • DA list of all employee email addresses
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A network administrator is analyzing a packet capture and sees a large amount of UDP traffic on port 53 between an internal host and an external DNS server. The internal host is sending many queries for the same domain name in a short period. What should the administrator suspect?

   • AA misconfigured application or malware generating excessive DNS queries.
   • BA DNS amplification attack using the internal host as a reflector.
   • CNormal DNS behavior for a busy client.
   • DA DNS cache poisoning attempt.
   Reveal Solution Discussion Select an answer first
6. 40expert · medium

   After completing a packet capture analysis, an analyst must write a report for management. The report should highlight a potential security incident. Which approach is most effective?

   • AOnly state that an incident occurred without details
   • BInclude the raw packet capture file for management to review
   • CFocus on the tools used and how the capture was performed
   • DProvide a summary of the suspicious traffic, including IPs, ports, and a timeline, and recommend next steps
   Reveal Solution Discussion Select an answer first