A security analyst is configuring an anomaly detection system for a data center that runs nightly batch jobs. The batch jobs transfer large files between servers from 2:00 AM to 4:00 AM. The analyst sets a static threshold for bandwidth usage and receives alerts every night during the batch window. What is the best way to reduce these false positives?

Disable alerts during the 2:00 AM to 4:00 AM window

Switch from flow data to full packet captures

Increase the static threshold to a value above the peak batch usage

Establish a time-based baseline that accounts for the nightly batch window

A security team must monitor traffic on a critical production segment without introducing any risk of disrupting live services. They need to see full packet contents for forensic analysis. Which approach should they choose?

Use NetFlow on the router and analyze flow records

Run a packet capture tool directly on the production server

Configure a SPAN port on the switch and connect a passive tap to the monitoring appliance

Deploy an inline intrusion prevention system that blocks malicious traffic

A network engineer is evaluating a new VoIP service. Users report that calls have choppy audio and occasional dropouts. The engineer needs to determine whether the network is delivering packets reliably. Which metric should the engineer examine first?

Number of flow records exported per minute

Syslog message rate from the firewall

Total bandwidth utilization on the core switch

Packet loss percentage on the VoIP traffic path

A small company wants to monitor network traffic for security purposes but has a limited budget and only a few IT staff. They need to see real-time traffic patterns, identify top talkers, and detect unusual spikes. They do not need deep packet inspection. Which tool would be the most appropriate?

Intrusion detection system (IDS)

EC-CouncilNetwork Defense Essentials

Domain 7Objective 1

Network Traffic Monitoring Concepts NDE Practice Questions (Page 8)

Part of the Network Traffic Monitoring domain, which makes up ~11% of our current practice bank.

47questions here

10free pages

7concepts

Questions 36–40

36application · medium
A network administrator needs to verify that a new firewall rule is working correctly by sending test traffic through the firewall and observing the response. Which monitoring technique is the administrator using?
Select an answer first
37expert · hard
A security analyst is configuring an anomaly detection system for a data center that runs nightly batch jobs. The batch jobs transfer large files between servers from 2:00 AM to 4:00 AM. The analyst sets a static threshold for bandwidth usage and receives alerts every night during the batch window. What is the best way to reduce these false positives?
Select an answer first
38application · medium
A security team must monitor traffic on a critical production segment without introducing any risk of disrupting live services. They need to see full packet contents for forensic analysis. Which approach should they choose?
Select an answer first
39application · medium
A network engineer is evaluating a new VoIP service. Users report that calls have choppy audio and occasional dropouts. The engineer needs to determine whether the network is delivering packets reliably. Which metric should the engineer examine first?
Select an answer first
40application · medium
A small company wants to monitor network traffic for security purposes but has a limited budget and only a few IT staff. They need to see real-time traffic patterns, identify top talkers, and detect unusual spikes. They do not need deep packet inspection. Which tool would be the most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Network Traffic Monitoring Concepts NDE Practice Questions (Page 8)

Questions 36–40

A network administrator needs to verify that a new firewall rule is working correctly by sending test traffic through the firewall and observing the response. Which monitoring technique is the administrator using?

A security team must monitor traffic on a critical production segment without introducing any risk of disrupting live services. They need to see full packet contents for forensic analysis. Which approach should they choose?

A network engineer is evaluating a new VoIP service. Users report that calls have choppy audio and occasional dropouts. The engineer needs to determine whether the network is delivering packets reliably. Which metric should the engineer examine first?

A small company wants to monitor network traffic for security purposes but has a limited budget and only a few IT staff. They need to see real-time traffic patterns, identify top talkers, and detect unusual spikes. They do not need deep packet inspection. Which tool would be the most appropriate?

Keep studying — Network Traffic Monitoring