CySA+ Network Traffic Anomalies Quiz

1. Which protocol analysis helps identify command and control (C2) communications?

HTTP traffic with regular, repetitive patterns

SMTP for email only

FTP for file transfers

DHCP for IP assignment

2. What is the importance of threat intelligence in network traffic analysis?

It has no practical application

It provides known indicators of compromise to identify malicious traffic

It only applies to antivirus software

It replaces all other security tools

3. Which network behavior suggests potential ransomware activity?

Normal user file access

Sudden encryption-related traffic and file share access patterns

Standard database operations

Regular backup processes

4. What is the primary advantage of using SIEM for traffic analysis?

It only monitors email

It correlates traffic data from multiple sources for comprehensive threat detection

It eliminates the need for firewalls

It reduces network bandwidth

5. Which scenario best represents a successful incident response to network anomalies?

Ignoring all traffic alerts

Detecting, analyzing, and containing threats based on traffic patterns

Blocking all external traffic

Deleting all logs immediately

6. What does monitoring TTL (Time to Live) values help detect?

Email delivery issues only

Spoofed packets or unusual routing paths

Bandwidth limitations

User login times

7. Which characteristic indicates a potential port scanning activity?

Connections to multiple ports on a target in short timeframe

Normal web server traffic

Standard database queries

Regular file transfers

8. What role does flow data play in network anomaly detection?

It provides only packet headers

It summarizes traffic patterns for rapid anomaly identification

It encrypts all network data

It eliminates the need for firewalls

9. Which indicator suggests a potential data breach through network traffic?

Encrypted internal communications

Large data transfers to external IP addresses at odd hours

Standard business email traffic

Regular software updates

10. What is the primary purpose of packet inspection in security operations?

To increase network speed

To examine payload contents for threats and policy violations

To reduce storage costs

To improve user experience

11. Which protocol is most commonly used to capture and analyze network traffic for security monitoring?

SNMP

Netflow

DNS

HTTP

12. What does a sudden increase in DNS queries to a single domain typically indicate?

Normal network operation

Malware beaconing or C2 communication

User visiting a popular website

Scheduled system maintenance

13. Which type of anomaly suggests lateral movement within a network?

High outbound HTTPS traffic

Unusual internal host-to-host communication patterns

Regular user web browsing

Standard email synchronization

14. What is the significance of monitoring failed login attempts in network traffic?

It has no security value

It indicates brute force or credential-stuffing attacks

It only applies to wireless networks

It improves data transfer speed

15. Which metric is essential for detecting unusual connection patterns?

Packet size only

Source IP, destination IP, port, and protocol

Color of network cables

Server uptime

16. What does DNS tunneling typically indicate in network traffic analysis?

Normal DNS query resolution

Potential data exfiltration using DNS queries

Improved network performance

Standard email delivery

17. Which network traffic pattern suggests a possible DDoS attack?

Steady, predictable traffic flow

Sudden, massive volume spike from multiple sources

Encrypted HTTPS connections only

Low-bandwidth, intermittent traffic

18. What is the primary purpose of baselining network traffic?

To block all traffic

To establish normal patterns for anomaly detection

To encrypt all data

To reduce bandwidth usage

19. Which tool is primarily used for real-time packet capture and analysis?

Wireshark

Nmap

Metasploit

Burp Suite

20. What does a spike in outbound traffic to unusual destinations typically indicate?

Normal user behavior

Potential data exfiltration or botnet activity

Scheduled backup operations

System updates

CySA+ Analyzing Network Traffic for Anomalies Quiz