Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A network analyst is reviewing a capture and notices a large amount of ICMP echo requests and replies between two hosts. The analyst suspects a possible covert channel. Which additional analysis would best confirm this suspicion?

   • AVerify the source and destination MAC addresses
   • BCount the number of ICMP packets
   • CExamine the payload of the ICMP packets for non-standard data
   • DCheck the TTL values in the IP headers
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   While analyzing a packet capture, an analyst sees a TCP packet with the SYN flag set and the ACK flag set, coming from a server to a client. What does this indicate about the communication?

   • AThe server is sending data to the client
   • BThe connection is being terminated
   • CThe client is initiating a new connection
   • DThe server is acknowledging the client's SYN and is ready to establish a connection
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of port mirroring on a managed switch?

   • ATo forward traffic from one port to another without changing the destination MAC address
   • BTo duplicate traffic from one or more source ports to a designated monitoring port for analysis
   • CTo block all traffic from a specific port to prevent unauthorized access
   • DTo combine multiple physical ports into a single logical link for increased bandwidth
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A network engineer needs to capture traffic between two servers on a switched network for troubleshooting. The engineer has administrative access to the switch. Which technique should be used to ensure the capture is passive and does not alter the traffic flow?

   • AUse ARP spoofing to redirect the servers' traffic to the monitoring machine.
   • BInstall a packet capture agent on each server.
   • CFlood the switch with MAC addresses to force it to broadcast all traffic.
   • DConfigure port mirroring on the switch to send a copy of the traffic to the monitoring port.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a common indicator that ARP spoofing may be occurring on a network?

   • AMultiple IP addresses mapping to the same MAC address in the ARP cache
   • BA sudden increase in TCP SYN packets to a single port
   • CA large number of DNS queries to external servers
   • DA switch's CAM table becoming full with fake MAC addresses
   Reveal Solution Discussion Select an answer first