Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team wants to detect ARP spoofing on their network. They have a monitoring server connected to a SPAN port. Which detection method is most effective?

   • AEnable DHCP snooping on the monitoring server.
   • BUse a port scanner to identify active hosts.
   • CMonitor ARP traffic on the SPAN port and look for multiple ARP replies for the same IP address.
   • DCheck the ARP cache on the monitoring server.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is examining a pcap file and sees a series of TCP SYN packets sent to a host on port 443, but no SYN-ACK responses. The source IP is spoofed. What is the most likely explanation?

   • AThe target is down and not responding.
   • BThe packets are part of a normal TCP handshake.
   • CA SYN flood attack is in progress.
   • DThe target is dropping packets due to a firewall rule.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which tool is a command-line packet analyzer that uses the libpcap library and is commonly used to capture and filter network traffic?

   • AWireshark
   • BNmap
   • Ctcpdump
   • DNetcat
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a network traffic flow?

   • AThe total amount of data transferred over a network in one day
   • BA sequence of packets sharing the same source IP, destination IP, source port, destination port, and protocol
   • CA collection of packets with the same destination MAC address
   • DA single packet transmitted between two hosts
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security analyst captures traffic and notices a large number of UDP packets sent to port 53. Which protocol is most likely being used?

   • AHTTP
   • BDNS
   • CSSH
   • DSMTP
   Reveal Solution Discussion Select an answer first