A security administrator wants to prevent unauthorized packet capture on the corporate network. Which measure is most effective?

Implement strong passwords on all devices.

Use switches instead of hubs throughout the network.

Disable all network monitoring tools.

While analyzing a pcap, an analyst sees a DNS query for a domain that is known to be malicious. What is the most appropriate next step?

Delete the pcap file to avoid false positives.

Investigate the source IP address and the context of the query.

Immediately block the domain at the firewall.

Ignore the query because DNS queries are common.

A network admin is asked to capture traffic on a network segment that uses a hub. The admin wants to ensure the capture does not alter the traffic flow. Which sniffing technique should the admin use?

Active sniffing using ARP spoofing

MAC flooding to force the switch to broadcast

Passive sniffing with the NIC in promiscuous mode

A security team has detected ARP spoofing on a network segment. They need to implement a countermeasure that will prevent the attack without requiring changes to end-user devices. Which solution is most appropriate?

Use static ARP entries on all hosts

Install personal firewalls on all end-user devices

Configure Dynamic ARP Inspection (DAI) on the switches

EC-CouncilNetwork Defense Essentials

Domain 7Objective 3

Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 3)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

41questions here

9free pages

8concepts

Questions 11–15

11application · medium
A security administrator wants to prevent unauthorized packet capture on the corporate network. Which measure is most effective?
Select an answer first
12application · medium
While analyzing a pcap, an analyst sees a DNS query for a domain that is known to be malicious. What is the most appropriate next step?
Select an answer first
13application · medium
A network admin is asked to capture traffic on a network segment that uses a hub. The admin wants to ensure the capture does not alter the traffic flow. Which sniffing technique should the admin use?
Select an answer first
14foundation · easy
Which tool provides a graphical interface for deep packet inspection, allowing users to view protocol hierarchies and follow TCP streams?
Select an answer first
15expert · hard
A security team has detected ARP spoofing on a network segment. They need to implement a countermeasure that will prevent the attack without requiring changes to end-user devices. Which solution is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.