Network Security Monitoring Tools GMON Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is using tcpdump to capture traffic on a Linux server that hosts a critical application. The server has multiple network interfaces, and the analyst wants to capture only traffic to and from the application's port (TCP 443) on the primary interface. Which tcpdump command should they use?

   • Atcpdump -i eth0 'tcp port 443' -c 100
   • Btcpdump -i any 'udp port 443' -w capture.pcap
   • Ctcpdump -i eth0 'port 80' -w capture.pcap
   • Dtcpdump -i eth0 -s 0 'tcp port 443' -w capture.pcap
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the primary purpose of network security monitoring tools in a continuous monitoring program?

   • ATo ensure compliance with regulatory standards only
   • BTo automate all security incident response actions
   • CTo provide ongoing visibility into network activity to detect and respond to security threats
   • DTo replace the need for intrusion prevention systems
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tool is specifically designed to inspect and interpret network traffic patterns to identify anomalies and potential threats?

   • ANetwork traffic analysis (NTA) tools
   • BPatch management tools
   • CVulnerability scanners
   • DConfiguration management tools
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is examining a pcap file and notices a series of TCP connections from a single internal host to many different external IPs on port 445. The analyst wants to determine if this is a scanning behavior or a legitimate data transfer. Which analysis technique would be most effective?

   • ACount the number of packets in each connection
   • BCheck the DNS logs for the external IPs
   • CLook at the source port numbers used
   • DUse a network traffic analysis tool to visualize the connections and identify patterns such as sequential IPs or timing
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a suspected data exfiltration from a web server. The team needs to reconstruct the exact HTTP requests and responses exchanged during the incident window to determine what data was accessed. The server is in a cloud environment where the team does not have access to the hypervisor. Which approach should the analyst use to capture the necessary evidence?

   • AEnable NetFlow export on the virtual switch and analyze flow records for the incident window.
   • BDeploy a network TAP or SPAN port on the virtual switch and run tcpdump to capture full packets.
   • CInstall a host-based agent on the web server to capture loopback traffic.
   • DUse the cloud provider's flow logs and correlate with web server access logs.
   Reveal Solution Discussion Select an answer first