Network Traffic Monitoring Concepts NDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network analyst is asked to provide evidence of a specific malicious payload that was sent to a server during a security incident. The incident occurred three days ago. The organization has NetFlow records and syslog data from that period, but full packet captures are only kept for 24 hours. Which data source can the analyst use to identify the exact payload?

   • AFull packet captures
   • BNone of the available data sources
   • CSyslog data
   • DNetFlow records
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A network monitoring system has been in place for three months. The administrator wants to configure alerts for unusual traffic patterns. What is the first step to ensure the alerts are meaningful?

   • AEstablish a baseline of normal network behavior
   • BSet alert thresholds based on vendor defaults
   • CEnable all available alert types
   • DConfigure alerts to trigger on any traffic increase
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A network administrator is reviewing traffic patterns and notices that bandwidth usage on a particular server has increased by 30% compared to the same time last week. The administrator wants to determine if this increase is a security concern. What should the administrator do first?

   • AReboot the server to clear any potential malware
   • BCheck whether the increase is within the normal variance of the established baseline
   • CIncrease the logging level on the server
   • DImmediately block the server's network access
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is troubleshooting why the intrusion detection system (IDS) is generating an overwhelming number of alerts. The analyst suspects that the alerts are triggered by legitimate encrypted traffic that the IDS cannot inspect. Which monitoring challenge is the analyst most likely facing?

   • AEncryption limiting visibility into payload contents
   • BHigh volume of flow data exceeding storage capacity
   • CLatency spikes affecting the IDS processing speed
   • DPacket loss causing incomplete session reconstruction
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A network engineer is troubleshooting intermittent connectivity issues. The engineer needs to see the exact sequence of packets exchanged during a failure to understand the handshake process. Which data source should the engineer use?

   • AFlow data from the router
   • BSNMP interface counters
   • CSyslog logs from the switch
   • DPacket data captured at the time of failure
   Reveal Solution Discussion Select an answer first