Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A network administrator wants to detect if any host on the network is running a packet sniffer in promiscuous mode. Which technique is most effective?

   • AMonitor the switch's CAM table for unusual MAC addresses
   • BCheck the ARP cache for duplicate entries
   • CSend a packet with a valid IP but an incorrect MAC address and see if the host responds
   • DUse a port scan to identify open ports
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which TCP flag is set in the first packet of a connection establishment handshake?

   • ASYN
   • BFIN
   • CACK
   • DRST
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security engineer needs to capture traffic on a switched network for a forensic investigation. The switch supports port mirroring, but the engineer is concerned that the attacker might detect the mirroring. Which approach minimizes the risk of detection while still capturing the needed traffic?

   • AUse MAC flooding to force the switch to broadcast all traffic
   • BDisconnect the target's cable and connect it to a hub
   • CUse ARP spoofing to redirect traffic to the analysis machine
   • DConfigure port mirroring to send a copy of the target's traffic to the analysis port
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A network administrator notices that a single workstation is generating a large amount of UDP traffic to a remote server on port 53. What is the most likely explanation?

   • AThe workstation is performing DNS queries.
   • BThe workstation is streaming video over HTTP.
   • CThe workstation is downloading a file via FTP.
   • DThe workstation is sending email via SMTP.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   While analyzing a pcap, an analyst sees a TCP packet with the SYN flag set and the ACK flag set. What does this indicate about the TCP handshake?

   • AIt is the first step, where the client initiates the connection.
   • BIt is the final step, where the client acknowledges the server's sequence number.
   • CIt indicates a connection reset.
   • DIt is the second step of the three-way handshake, acknowledging the client's SYN and synchronizing the server's sequence number.
   Reveal Solution Discussion Select an answer first