A network administrator captured a pcap file and needs to identify which IP addresses are communicating and over which protocols. The administrator wants to quickly see a summary of all conversations. Which tool feature is best suited for this?

Tshark's -r option with a display filter

Wireshark's Statistics > Conversations

A network admin needs to capture traffic on a switch that does not support port mirroring. The admin has physical access to the switch and can connect a device. Which technique should the admin use to capture traffic between two specific ports?

Insert a hub between the target device and the switch

Use MAC flooding to force the switch to broadcast

Use ARP spoofing to redirect traffic

A security analyst is investigating a suspected ARP spoofing attack on a network segment. The analyst needs to capture the attacker's traffic without alerting the attacker. The switch does not support port mirroring. Which approach is the most appropriate?

Use a hub between the switch and the gateway.

Use a passive tap on the link between the switch and the gateway.

Perform MAC flooding on the switch to force all traffic to broadcast.

Send ARP replies to the attacker to redirect their traffic to the analyst's machine.

EC-CouncilNetwork Defense Essentials

Domain 7Objective 3

Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 6)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

41questions here

9free pages

8concepts

Questions 26–30

26foundation · easy
Which technique involves sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, allowing the attacker to intercept traffic?
Select an answer first
27application · medium
A network administrator captured a pcap file and needs to identify which IP addresses are communicating and over which protocols. The administrator wants to quickly see a summary of all conversations. Which tool feature is best suited for this?
Select an answer first
28application · medium
An analyst is analyzing a pcap file and wants to see only the TCP packets that have the RST flag set. Which Wireshark display filter should be used?
Select an answer first
29application · medium
A network admin needs to capture traffic on a switch that does not support port mirroring. The admin has physical access to the switch and can connect a device. Which technique should the admin use to capture traffic between two specific ports?
Select an answer first
30expert · hard
A security analyst is investigating a suspected ARP spoofing attack on a network segment. The analyst needs to capture the attacker's traffic without alerting the attacker. The switch does not support port mirroring. Which approach is the most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 6)

Questions 26–30

Which technique involves sending forged ARP replies to associate the attacker's MAC address with the IP address of a legitimate host, allowing the attacker to intercept traffic?

A network administrator captured a pcap file and needs to identify which IP addresses are communicating and over which protocols. The administrator wants to quickly see a summary of all conversations. Which tool feature is best suited for this?

An analyst is analyzing a pcap file and wants to see only the TCP packets that have the RST flag set. Which Wireshark display filter should be used?

A network admin needs to capture traffic on a switch that does not support port mirroring. The admin has physical access to the switch and can connect a device. Which technique should the admin use to capture traffic between two specific ports?

A security analyst is investigating a suspected ARP spoofing attack on a network segment. The analyst needs to capture the attacker's traffic without alerting the attacker. The switch does not support port mirroring. Which approach is the most appropriate?

Keep studying — Network Traffic Monitoring