Network Traffic Analysis GSOC Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   Which of the following is a common indicator of an anomaly in network traffic flow analysis?

   • AA stable pattern of SSH connections from an administrator's workstation
   • BA sudden increase in outbound data transfer from a single host
   • CRegular HTTP traffic to a well-known website
   • DConsistent periodic DNS queries to a known legitimate domain
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   An analyst needs to capture traffic on a high-traffic network segment to investigate a possible malware infection. The analyst has limited disk space and needs to capture only the relevant traffic. The malware is known to communicate over HTTP and DNS. Which capture strategy is most appropriate?

   • AUse Wireshark to capture traffic and apply a display filter for HTTP and DNS after the capture.
   • BCapture all traffic to a large disk to ensure nothing is missed.
   • CCapture only the first 100 bytes of each packet to save space.
   • DUse tcpdump with a BPF filter for port 80 and port 53, and write to a ring buffer to limit disk usage.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is reviewing NetFlow data and notices a large volume of data being transferred from an internal database server to an external IP address during off-hours. The transfer is over port 443. The analyst needs to determine if this is a data exfiltration. Which additional data source would be most useful to confirm the nature of the transfer?

   • AFull packet capture of the session to inspect the payload and determine if it contains sensitive data.
   • BNetFlow records from the same period to verify the byte count.
   • CDNS logs to see if the external IP resolves to a known domain.
   • DFirewall logs to confirm the connection was allowed.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is reviewing NetFlow data and notices that a single internal host is communicating with multiple external IP addresses on port 22 (SSH) simultaneously. The host is a user workstation. What is the most likely explanation?

   • AThe host is compromised and is being used to brute-force SSH credentials on external servers
   • BThe host is experiencing a network misconfiguration
   • CThe host is running a legitimate SSH tunnel for secure communication
   • DThe host is performing a legitimate SSH connection to multiple servers
   Reveal Solution Discussion Select an answer first