Network Sniffing Techniques and Traffic Analysis NDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   In an IPv4 packet header, which field is used to identify the protocol carried in the payload, such as TCP or UDP?

   • AIdentification field
   • BProtocol field
   • CType of Service (ToS) field
   • DHeader checksum field
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an ethical and legal consideration when performing network sniffing?

   • ASniffing is legal as long as the captured data is not shared with third parties
   • BSniffing is always legal if the intent is to improve network security
   • CSniffing must be performed only on networks or devices for which the individual has explicit authorization
   • DSniffing is only allowed on networks that use encryption
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following is a common use of traffic flow analysis?

   • AChanging firewall rules to block malicious IP addresses
   • BIdentifying which applications are consuming the most bandwidth
   • CDecrypting encrypted traffic to read the payload
   • DReplacing the need for intrusion detection systems
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A network administrator wants to use a packet capture tool to diagnose why a web server is responding slowly. What is the primary legitimate purpose of network sniffing in this scenario?

   • ATo intercept and read the contents of encrypted HTTPS traffic
   • BTo block malicious traffic destined for the web server
   • CTo analyze network traffic to identify performance bottlenecks and troubleshoot connectivity issues
   • DTo modify packets in transit to prioritize web server traffic
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network administrator notices a sudden spike in outbound traffic from a single workstation to a known command-and-control server. The admin wants to analyze the traffic flow to determine the communication pattern and identify which protocol is being used. Which approach is most effective?

   • ACheck the Windows Event Log for application errors
   • BRun a port scan with Nmap against the workstation to identify open ports
   • CDisable the workstation's network adapter to stop the traffic
   • DUse NetFlow to view flow records and then capture packets with Wireshark for protocol analysis
   Reveal Solution Discussion Select an answer first