Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is examining a packet capture and sees a TCP connection with the SYN flag set, followed by a RST flag from the destination, and then a SYN retransmission. What is the most likely cause?

   • AThe source is performing a port scan
   • BThe destination is experiencing a denial-of-service attack
   • CThe source is using a VPN
   • DThe destination port is closed, and the host is rejecting the connection
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary difference between passive and active sniffing?

   • APassive sniffing only works on wireless networks, while active sniffing works on wired networks
   • BPassive sniffing requires root privileges, while active sniffing does not
   • CPassive sniffing injects packets into the network, while active sniffing only observes traffic
   • DPassive sniffing captures traffic without altering it, while active sniffing actively manipulates the network to redirect traffic to the sniffer
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is examining a packet capture and sees a large number of UDP packets from a single source IP to a single destination IP on port 53. What is the most likely protocol and purpose of this traffic?

   • ASMTP email transmission
   • BDNS queries and responses
   • CHTTP web requests
   • DSSH remote administration
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In which of the following network environments would passive sniffing be most effective without additional techniques?

   • AA network with a switch that has port security enabled
   • BA network with a router that filters traffic based on MAC addresses
   • CA network using a hub, where all connected devices receive all traffic
   • DA modern switched network where each port only receives traffic destined for its connected device
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A network engineer is asked to capture traffic on a network segment to verify that a new application is working correctly. The engineer has permission from the application owner. What is the most important ethical consideration?

   • ACapture all traffic on the segment to be thorough.
   • BShare the capture with other teams for transparency.
   • CKeep the capture indefinitely for future reference.
   • DEnsure the capture is limited to the application's traffic and does not include unrelated personal data.
   Reveal Solution Discussion Select an answer first