GCIA Network Traffic Anomaly Analysis

1. What is the primary advantage of using statistical anomaly detection over signature-based detection?

It requires no training data or baseline establishment

It can identify previously unknown attacks that deviate from normal patterns

It eliminates all false positives

It replaces the need for network firewalls

2. True or False: Anomaly detection systems eliminate the need for incident response procedures.

True

False

3. Which tool is commonly used to capture and analyze network traffic in packet-level detail?

Wireshark

Nmap

Nessus

Metasploit

4. A network shows traffic to an internal IP using a reserved or private address range from an external source. What does this indicate?

Normal internet routing behavior

Potential IP spoofing or misconfiguration anomaly

Standard DHCP operations

Legitimate cloud backup activity

5. What is a key difference between network-based and host-based anomaly detection?

Network-based observes traffic patterns; host-based monitors system behavior and logs

Host-based is more expensive but less accurate

Network-based cannot detect internal threats

Host-based analyzes packet headers only

6. True or False: Analyzing the entropy of packet payloads can help detect encrypted malware communications.

True

False

7. In network anomaly analysis, what does 'tuning' refer to?

Adjusting detection thresholds to reduce false positives while maintaining detection accuracy

Increasing network bandwidth capacity

Replacing all network cables

Changing firewall rule order

8. A host sends packets with fragmentation flags set unusually. What anomaly might this represent?

Normal large file transfers

Potential evasion technique to bypass IDS detection

Standard DNS operations

Legitimate VoIP traffic

9. Which metric is most useful for detecting a potential data exfiltration event?

Inbound packet count only

Unusual outbound traffic volume and destination patterns

Average packet TTL value

Source port numbers exclusively

10. True or False: DNS exfiltration always uses standard DNS query response sizes.

True

False

11. What is the primary purpose of analyzing network traffic anomalies in an IDS environment?

To identify deviations from normal network behavior that may indicate security threats

To optimize bandwidth utilization across all network segments

To increase overall network latency for security purposes

To replace all firewall rules with anomaly-based detection

12. An internal host connects to multiple external IPs on port 445 in rapid succession. What might this indicate?

Standard file sharing operations

Potential lateral movement or worm propagation attempt

Normal backup procedures

Legitimate software updates

13. What does deep packet inspection (DPI) enable analysts to detect?

Only source and destination IP addresses

Payload content and application-level anomalies within encrypted traffic

Physical layer cable faults

User login credentials only

14. Which of the following is a characteristic of a SYN flood attack visible in traffic analysis?

High volume of SYN packets with no corresponding ACK responses

Balanced SYN and ACK packets throughout the connection

Exclusively UDP traffic from multiple sources

Normal three-way handshake completion

15. True or False: A connection using port 443 is always encrypted and therefore safe from inspection.

True

False

16. What is a baseline in network anomaly detection?

The minimum packet size allowed on the network

A reference profile of normal network behavior against which deviations are measured

The default TTL value for all IP packets

The maximum bandwidth threshold per user

17. An anomaly detector observes 1,000 DNS queries in 10 seconds from a single host. What threat does this suggest?

Normal DNS caching behavior

Potential DNS tunnel or data exfiltration attempt

Standard web browsing activity

Legitimate bulk email operations

18. In packet analysis, what is the significance of the TCP flags (SYN, ACK, FIN)?

They control packet encryption standards

They indicate the state and purpose of TCP connections

They determine packet payload size

They specify the source port number

19. What does a sudden spike in ICMP echo request traffic typically indicate?

Normal ping sweeps for network discovery

Potential reconnaissance activity or DDoS preparation

Legitimate traceroute operations only

Standard network maintenance procedures

20. Which network protocol operates at Layer 3 and is commonly analyzed for anomalies?

TCP

UDP

IP

DNS

GCIA Network Traffic Anomaly Analysis Quiz

1. What is the primary advantage of using statistical anomaly detection over signature-based detection?

2.

What first name or nickname would you like us to use?

2. True or False: Anomaly detection systems eliminate the need for incident response procedures.

3. Which tool is commonly used to capture and analyze network traffic in packet-level detail?

4. A network shows traffic to an internal IP using a reserved or private address range from an external source. What does this indicate?

5. What is a key difference between network-based and host-based anomaly detection?

6. True or False: Analyzing the entropy of packet payloads can help detect encrypted malware communications.

7. In network anomaly analysis, what does 'tuning' refer to?

8. A host sends packets with fragmentation flags set unusually. What anomaly might this represent?

9. Which metric is most useful for detecting a potential data exfiltration event?

10. True or False: DNS exfiltration always uses standard DNS query response sizes.

11. What is the primary purpose of analyzing network traffic anomalies in an IDS environment?

12. An internal host connects to multiple external IPs on port 445 in rapid succession. What might this indicate?

13. What does deep packet inspection (DPI) enable analysts to detect?

14. Which of the following is a characteristic of a SYN flood attack visible in traffic analysis?

15. True or False: A connection using port 443 is always encrypted and therefore safe from inspection.

16. What is a baseline in network anomaly detection?

17. An anomaly detector observes 1,000 DNS queries in 10 seconds from a single host. What threat does this suggest?

18. In packet analysis, what is the significance of the TCP flags (SYN, ACK, FIN)?

19. What does a sudden spike in ICMP echo request traffic typically indicate?

20. Which network protocol operates at Layer 3 and is commonly analyzed for anomalies?