A security operations center (SOC) is overwhelmed by alerts from its monitoring tools. Many alerts are false positives caused by legitimate administrative activity that occurs at regular intervals. The SOC wants to reduce alert fatigue without missing real threats. What is the best approach?

Create suppression rules for the known administrative activity and review them periodically

Increase the alert threshold globally to reduce the number of alerts

Disable the monitoring tools during the administrative windows

Ignore all alerts that occur during the administrative windows

A network team must monitor a remote branch office that has limited bandwidth and no on-site IT staff. They need to detect abnormal traffic patterns without sending large amounts of data to the central office. Which monitoring technique is most suitable?

Use an active probe that sends test packets across the WAN every minute

Install a packet analyzer on the branch router and have staff review it manually

Set up a full packet capture at the branch and stream it to the central office

Deploy a flow-based collector at the branch that exports only summary records

A SOC analyst is reviewing alerts from a network monitoring tool. The tool flags a large amount of traffic to a cloud storage provider from a single workstation during business hours. The workstation is used by the marketing team, which frequently uploads large video files. The analyst needs to determine if this is a security incident. Which action is most appropriate?

Immediately block the workstation's access to the cloud storage provider

Escalate the alert to a senior incident responder

Ignore the alert because the destination is a well-known cloud provider

Check the user's activity and compare the traffic to the marketing team's baseline

What does the packet loss metric indicate in network traffic analysis?

The maximum capacity of the network link

The percentage of packets that do not reach their destination

The total number of bytes transmitted per second

The time it takes for a packet to travel from source to destination

A network team needs to measure the round-trip time between two offices to evaluate the quality of the WAN link. They plan to send a small number of test packets and measure the response time. Which monitoring technique and tool combination is most appropriate?

Active monitoring using ping or traceroute

Passive monitoring using a SPAN port

EC-CouncilNetwork Defense Essentials

Domain 7Objective 1

Network Traffic Monitoring Concepts NDE Practice Questions (Page 2)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

47questions here

10free pages

7concepts

Questions 6–10

6expert · hard
A security operations center (SOC) is overwhelmed by alerts from its monitoring tools. Many alerts are false positives caused by legitimate administrative activity that occurs at regular intervals. The SOC wants to reduce alert fatigue without missing real threats. What is the best approach?
Select an answer first
7application · medium
A network team must monitor a remote branch office that has limited bandwidth and no on-site IT staff. They need to detect abnormal traffic patterns without sending large amounts of data to the central office. Which monitoring technique is most suitable?
Select an answer first
8expert · hard
A SOC analyst is reviewing alerts from a network monitoring tool. The tool flags a large amount of traffic to a cloud storage provider from a single workstation during business hours. The workstation is used by the marketing team, which frequently uploads large video files. The analyst needs to determine if this is a security incident. Which action is most appropriate?
Select an answer first
9foundation · easy
What does the packet loss metric indicate in network traffic analysis?
Select an answer first
10application · medium
A network team needs to measure the round-trip time between two offices to evaluate the quality of the WAN link. They plan to send a small number of test packets and measure the response time. Which monitoring technique and tool combination is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.