CySA+ Network Traffic Anomalies Analysis

1. What does a NetFlow record showing zero-byte connections typically represent?

Successful data transfer

Connection establishment without data exchange

Completed file transfer

Encrypted traffic stream

Submit

5. Monitoring for DNS queries to domains with newly registered (fresh) registrations helps detect what?

Legitimate company website launches

Malware callbacks and phishing infrastructure

Normal internet user behavior

Scheduled DNS updates

6. Which indicator of compromise involves observing repeated failed authentication attempts followed by success?

Abnormal file access patterns

Successful privilege escalation

Credential compromise via brute force

Unauthorized data deletion

7. A sudden shift in traffic patterns to a user's home IP address after hours suggests what?

Authorized remote work

Possible account compromise or unauthorized access

Normal evening activity

Scheduled system backup

8. Detecting TLS/SSL certificate anomalies in network traffic can reveal which threat?

Buffer overflow vulnerabilities

Man-in-the-middle or SSL stripping attacks

Privilege escalation attempts

Cross-site scripting flaws

9. Which log source provides the most detailed packet-level information for traffic analysis?

Syslog messages

Packet captures (PCAP)

NetFlow records

Firewall block logs

10. An employee's workstation generating traffic to known malicious IP addresses indicates what security concern?

Legitimate software update

Possible malware infection

Normal web browsing

Authorized VPN connection

11. Which network traffic pattern most commonly indicates a data exfiltration attempt?

High-volume outbound traffic to external IPs on non-standard ports

Increased inbound traffic during business hours

Symmetric upload and download rates

Regular DNS queries to internal servers

12. Which metric is most useful for detecting volumetric DDoS attacks?

Packet loss percentage

Average response time

Sudden increase in traffic volume beyond baseline

Number of active TCP connections

13. A spike in ICMP traffic with unusual payload sizes may indicate which type of attack?

SQL injection attack

Covert tunneling or data exfiltration

Phishing campaign

Social engineering attempt

14. What is the primary purpose of baselining network traffic?

To increase bandwidth capacity

To establish normal behavior patterns for anomaly detection

To reduce encryption overhead

To improve user experience

15. Which protocol anomaly indicates potential lateral movement within a network?

Unexpected SMB traffic between internal systems

Regular HTTP traffic to web servers

Standard SSH access to authorized servers

Routine DHCP client requests

16. An unusually high number of connection attempts to random ports on a single host suggests what type of activity?

Legitimate application testing

Port scanning reconnaissance

Normal network maintenance

Scheduled backup operations

17. Detecting beaconing behavior in network traffic helps identify which security threat?

Unpatched software vulnerabilities

Active command and control malware infections

Weak password policies

Missing firewall rules

18. Which tool is primarily used to capture and analyze live network traffic for anomaly detection?

Wireshark

Nessus

Metasploit

Burp Suite

19. What does an abnormal increase in DNS traffic to unusual domains typically indicate?

Legitimate network expansion

Possible malware command and control communication

Normal user browsing behavior

Scheduled system updates

20. A sudden spike in failed login attempts followed by successful authentication suggests which type of attack?

Distributed denial of service

Credential stuffing or brute force attack

Man-in-the-middle interception

DNS poisoning

CySA+ Analyzing Network Traffic for Anomalies Quiz