Network Traffic Monitoring Concepts NDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A SOC is monitoring a network that uses a mix of encrypted and unencrypted protocols. The monitoring tool is generating a high volume of alerts for 'encrypted traffic to unknown destinations'. The SOC team is spending too much time investigating these alerts, and most turn out to be legitimate. What is the most effective way to improve the alert quality?

   • AIncrease the alert threshold for encrypted traffic volume
   • BDisable alerts for encrypted traffic
   • CDecrypt all encrypted traffic for inspection
   • DCreate a baseline of known encrypted traffic destinations and alert only on deviations
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which monitoring technique involves placing a sensor on a network segment to observe traffic as it passes, without altering the traffic flow?

   • APassive monitoring
   • BSynthetic monitoring
   • CActive monitoring
   • DAgent-based monitoring
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A network administrator needs to monitor traffic on a network segment where the switch does not support SPAN ports. The administrator needs to see all traffic passing through the segment for analysis. Which tool or technique is most appropriate?

   • AUse NetFlow on the router
   • BUse SNMP to monitor interface counters
   • CInstall a packet capture tool on each device
   • DInsert a network TAP between the switch and the devices on the segment
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is a common use case for active monitoring?

   • ADetecting zero-day malware in real time
   • BMeasuring real user experience on a live network
   • CProactively testing network performance and availability
   • DCapturing full packet payloads for forensic analysis
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A monitoring analyst notices that the help desk receives complaints about slow application performance every weekday at 10:00 AM. The analyst wants to determine whether this is a new problem or a normal pattern. What is the most appropriate first step?

   • AReboot the application server to clear any temporary issues
   • BCompare current latency and throughput metrics to a baseline established from historical data
   • CIncrease the logging level on the firewall to capture every packet
   • DImmediately block all traffic to the application server
   Reveal Solution Discussion Select an answer first