Network Traffic Monitoring Concepts NDE Practice Questions (Page 10)

Questions 46–47

1. 46application · medium

   A network administrator needs to identify which internal hosts are generating the most traffic to external IP addresses over the past week. The administrator wants a lightweight solution that does not require storing full packet captures. Which type of data should the administrator analyze?

   • AFull packet captures from a SPAN port
   • BFlow data from the router's NetFlow export
   • CSNMP interface counters from the switch
   • DSyslog logs from the firewall
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A network monitoring system has been generating a high number of alerts for a particular server that regularly sends large backups to an off-site storage provider every night at 2:00 AM. The alerts are flagged as 'unusual bandwidth usage' because the traffic volume exceeds the daily average. The SOC team is overwhelmed by these alerts. What is the most effective way to reduce the false positives while maintaining visibility?

   • AIncrease the alert threshold to a level that the backup traffic never exceeds
   • BCreate a baseline exception for the scheduled backup window
   • CDisable alerts for that server entirely
   • DIgnore the alerts because they are from a scheduled task
   Reveal Solution Discussion Select an answer first