Network Traffic Monitoring and Analysis Quiz

1. Which HTTP status code in traffic logs might indicate a successful web shell upload or compromise?

200 OK

404 Not Found

301 Redirect

500 Internal Server Error

2. What is the primary advantage of implementing automated alerting in network traffic monitoring?

Instant response to detected threats without manual review

Increased network latency

Reduced monitoring accuracy

Elimination of all network traffic

3. How can YARA rules enhance network traffic analysis capabilities?

They replace network monitoring entirely

They identify malicious patterns in network traffic and payloads

They increase bandwidth consumption

They eliminate encryption protocols

4. What does exfiltration detection in traffic analysis identify?

Incoming malware downloads

Unauthorized outbound data transfer

Network configuration changes

Firewall rule updates

5. Which metric is critical when evaluating network monitoring tool performance?

CPU and memory usage

Monitor color display

Physical device size

Keyboard responsiveness

6. What is a false positive in network anomaly detection?

A legitimate activity incorrectly flagged as malicious

A malicious activity that goes undetected

A network latency issue

A DNS resolution failure

7. How does traffic filtering improve network monitoring efficiency?

It increases all network traffic

It focuses analysis on relevant traffic and reduces noise

It encrypts all data

It removes all security controls

8. What does a spike in port 445 traffic typically indicate?

Web server activity

DNS queries

Potential SMB/ransomware activity

Email transmission

9. Which tool would you use for real-time network traffic analysis on a Linux system?

Tcpdump

Notepad

Calculator

Paint

10. What is the significance of monitoring SSL/TLS handshakes in network traffic?

They have no security relevance

They detect certificate anomalies and potential man-in-the-middle attacks

They measure bandwidth consumption only

They replace password authentication

11. What is the primary purpose of network traffic monitoring in a cybersecurity context?

Increase network bandwidth

Detect and identify security threats and anomalies

Replace firewalls completely

Reduce hardware costs

12. How can anomaly detection improve network security monitoring?

It eliminates all network traffic

It identifies deviations from normal behavior patterns

It replaces intrusion detection systems

It increases network speed

13. What does NetFlow provide in network monitoring?

Full packet payload inspection

Aggregated flow statistics and network traffic summaries

Real-time video streaming

Email encryption services

14. Which of the following is a characteristic of a DDoS attack visible in traffic analysis?

Encrypted payload data

Sudden spike in traffic from multiple sources

Reduced network latency

Increased DNS resolution speed

15. What is a behavioral baseline in network traffic monitoring?

The minimum network speed required

Normal traffic patterns established for comparison

The maximum packet size allowed

A type of encryption standard

16. Which protocol analysis helps identify suspicious DNS queries that may indicate malware communication?

HTTP analysis

DNS traffic analysis

SMTP analysis

FTP analysis

17. What is an indicator of compromise (IOC) in network traffic analysis?

A sign of potential malicious activity or breach

A type of firewall rule

A network bandwidth measurement

A routing protocol configuration

18. Which OSI layer does network traffic monitoring primarily focus on?

Layer 1 (Physical)

Layer 2 (Data Link)

Layers 2-4 (Data Link, Network, Transport)

Layer 7 (Application) only

19. What does PCAP stand for in network traffic analysis?

Protocol Capture and Processing

Packet Capture

Port Configuration and Protection

Proxy Cache and Protocol

20. Which tool is most commonly used to capture and analyze network packets at the packet level?

Wireshark

Apache

MySQL

Visual Studio

CND Network Traffic Monitoring and Analysis Quiz