Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Network+ > Network Monitoring > Flashcards

Network Monitoring Flashcards

(81 cards)

Start Studying
1
Q

What does an Intrusion Detection System (IDS) do?

A

Detects network threats and is a passive device that monitors network traffic, logs, and alerts

An IDS does not take action to block threats but rather provides alerts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary function of an Intrusion Prevention System (IPS)?

A

Detects network threats and responds to them as an active device operating in line, blocking offending traffic

An IPS takes immediate action to prevent detected threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Snort?

A

Software-based IDS/IPS that is open-source and widely used

Snort can be configured to detect various types of network attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the challenges associated with IPS?

A

False positives can lead to blocking legitimate traffic

This can disrupt normal network operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name the three detection methods used in intrusion detection systems.

A
  • Signature-based
  • Policy-based
  • Anomaly-based

Each method has its own approach to identifying threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the difference between network-based and host-based IDS/IPS?

A
  • Network-based – protects entire network
  • Host-based – installed on individual hosts

A combination of both can provide more comprehensive protection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is Simple Network Management Protocol (SNMP)?

A

An Internet protocol for collecting, organizing, and modifying information about managed devices on IP networks

SNMP can also be used to change device behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are SNMP agents?

A

Network devices sending information to the SNMP manager

They play a crucial role in the SNMP architecture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the message types in SNMP?

A
  • Set
  • Get
  • Trap

Each type serves a different function in communication between the manager and agents.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of a Granular Trap in SNMP?

A

Each SNMP trap message is sent with a unique Object Identifier (OID)

This helps in identifying specific variables that can be monitored.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does SNMPv3 provide that the previous versions do not?

A

Most secure with integrity, authentication, and confidentiality features

It uses hashing and encryption to enhance security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the function of network sensors?

A

Allows different access privileges for enhanced network protection and management

They monitor device performance among other functions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does a temperature sensor report?

A

Device chassis temperature with minor and major thresholds indicating different levels of heat

Excessive heat can lead to performance issues or failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is considered normal CPU usage/utilization?

A

5% to 40%

High utilization may indicate misconfiguration or other issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the consequences of network attacks?

A
  • Packet drops
  • Connection failure

These consequences can significantly disrupt network operations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a packet capture?

A

Used to capture all data going to or from a network device

It helps in analyzing network traffic and identifying issues.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is a SYN Flood attack?

A

Flood of SYN packets, without completing the three-way handshake, to overwhelm a server

This type of attack aims to exhaust server resources.

YOU WONT SEE THE PORT NUMBERS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is flow analysis in network monitoring?

A

Recording of metadata and statistics about network traffic using flow collector tools

It does not capture the content of the traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the purpose of NetFlow?

A

Cisco-developed means of reporting network flow information to a structured database

It helps in analyzing traffic patterns and behaviors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does Syslog do in network logging?

A

Transmits logs to a central server, simplifying the process of collecting logs from all devices

This is crucial for large networks to manage log data effectively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the eight severity levels of Syslog?

A
  • 0 – Emergency
  • 1 – Alert
  • 2 – Critical
  • 3 – Error
  • 4 – Warning
  • 5 – Notice
  • 6 – Information
  • 7 – Debugging

Each level indicates the severity of the log message.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the purpose of Security Information and Event Management (SIEM)?

A

Provides real-time or near real-time analysis of security alerts generated by network hardware and applications

SIEM helps maintain a strong security posture.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the main functions of SIEM?

A
  • Log Collection
  • Normalization
  • Correlation
  • Aggregation
  • Reporting

These functions enhance the ability to detect and respond to threats.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the role of log normalization in SIEM?

A

Map log messages from different systems into a common data model for analysis

This process makes it easier to analyze diverse log data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the significance of monitoring network performance metrics?
Ensures optimal network performance by focusing on end-to-end user experience ## Footnote Metrics like latency, bandwidth, and jitter are crucial for this monitoring.
26
What is considered high latency in network performance?
Measured in milliseconds and slows down network performance ## Footnote High latency is especially problematic for real-time applications.
27
What does Quality of Service (QoS) do?
Implements priority for voice and video traffic to manage jitter ## Footnote This helps maintain the quality of real-time communication.
28
What does interface statistics provide?
Detailed information about the status and performance of network interfaces ## Footnote This information is useful for troubleshooting connectivity issues.
29
What does 'Link State' indicate in interface statistics?
Whether the interface has a cable connected and a valid protocol for communication ## Footnote It helps in determining if the interface is operational.
30
What does the link state indicate?
Indicates whether the interface has a cable connected and a valid protocol for communication ## Footnote Example: “FastEthernet 0/0 is up, line protocol is up” indicates the interface is physically connected and operational.
31
What is the optimal speed and duplex mode for fast Ethernet?
100BaseTX/FX ## Footnote 100 Mbps bandwidth, full duplex, using either copper or fiber cabling.
32
What do Send and Receive Traffic Statistics track?
Tracks the number of packets and bytes sent and received by the interface.
33
What does high CRC errors indicate?
May indicate issues with cabling or electromagnetic interference.
34
What information does Protocol Packet and Byte Counts provide?
Provides detailed counts of packets and bytes for different protocols.
35
What do Input and Output Errors count?
Counts errors in received and transmitted packets, indicating potential issues with the interface or network.
36
What does the MTU size refer to?
Maximum Transmission Unit size of the interface, default is 1500 bytes for Ethernet.
37
What is the reliability measure for a connection?
Indicates the reliability of the connection, with 255/255 being the best.
38
What does TxLoad indicate?
Indicates how busy the router is transmitting frames over the connection.
39
What does the Keep Alive interval specify?
Specifies the interval at which the router sends keep alive packets to check if connected devices are still online, default is 10 seconds.
40
What does the Queuing Strategy specify?
Specifies the queuing strategy, with FIFO being the default for Ethernet.
41
What is a Runt in Ethernet terminology?
An Ethernet frame that is less than 64 bytes in size.
42
What is a Giant in Ethernet terminology?
Any Ethernet frame that exceeds the 802.3 frame size of 1518 bytes received.
43
What does Throttle indicate?
Occurs when the interface fails to buffer the incoming packets.
44
What is the significance of the Watchdog counter?
Counts times the watchdog timer has expired whenever a packet over 2048 bytes is received.
45
What does Output Errors count?
Counts collisions and interface resets, with 0 indicating full duplex.
46
What does Deferred count indicate?
Counts the number of frames transmitted successfully after waiting, with 0 indicating full duplex.
47
What could indicate a problem if the Unknown Protocol Drops count is high?
Counts packets dropped when the device couldn't determine the protocol.
48
What does the term Babble refer to in networking?
Counts any frame that is transmitted and larger than 1518 bytes.
49
What is the implication of a high number of Input Errors?
Counts frames received with errors, indicating potential issues.
50
What is indicated by the number of Ignored packets?
Counts packets ignored due to low internal buffers, rising during noise or broadcast storms.
51
What is the purpose of analyzing interface statistics?
To troubleshoot network issues.
52
Fill in the blank: The default MTU size for Ethernet is _______.
1500 bytes
53
True or False: A full duplex connection will have a collision count of 0.
True
54
What should be checked if experiencing slow network performance?
Duplex settings and for excessive collisions or errors.
55
RAM usage over 80% is bad?
TRUE
56
EXAM DISTRIBUTED DENIAL OF SERVICE ATTACK
half open connections eat up resources on the same server, same destination IPs, but different source IPs
57
What is NetFlow?
Cisco-developed means of reporting network flow information to a structured database ## Footnote NetFlow defines traffic flow based on packets that share the same characteristics.
58
What does NetFlow define?
Traffic flow based on packets that share the same characteristics ## Footnote This allows for effective monitoring and analysis of network traffic.
59
What is Zeek?
A hybrid tool that passively monitors the network ## Footnote Zeek is designed to enhance network security through monitoring.
60
What does Zeek do when something of interest is detected?
Logs full packet captures based on configured parameters and rules ## Footnote This functionality allows for detailed analysis of suspicious activities.
61
In what formats does Zeek normalize and store data?
Tab-delimited or JSON formats ## Footnote These formats ensure compatibility with various cybersecurity and network monitoring tools.
62
True or False: Zeek can only log data in one specific format.
False ## Footnote Zeek can log data in both tab-delimited and JSON formats.
63
Fill in the blank: NetFlow is a means of reporting network flow information to a _______.
structured database ## Footnote This structured approach helps in organizing and analyzing network data.
64
What is one key feature of Zeek?
Passively monitors the network ## Footnote This passive monitoring helps in detecting anomalies without affecting network performance.
65
What is NetFlow?
Cisco-developed means of reporting network flow information to a structured database ## Footnote NetFlow defines traffic flow based on packets that share the same characteristics.
66
What does NetFlow define?
Traffic flow based on packets that share the same characteristics ## Footnote This allows for effective monitoring and analysis of network traffic.
67
What is Zeek?
A hybrid tool that passively monitors the network ## Footnote Zeek is designed to enhance network security through monitoring.
68
What does Zeek do when something of interest is detected?
Logs full packet captures based on configured parameters and rules ## Footnote This functionality allows for detailed analysis of suspicious activities.
69
In what formats does Zeek normalize and store data?
Tab-delimited or JSON formats ## Footnote These formats ensure compatibility with various cybersecurity and network monitoring tools.
70
True or False: Zeek can only log data in one specific format.
False ## Footnote Zeek can log data in both tab-delimited and JSON formats.
71
Fill in the blank: NetFlow is a means of reporting network flow information to a _______.
structured database ## Footnote This structured approach helps in organizing and analyzing network data.
72
What is one key feature of Zeek?
Passively monitors the network ## Footnote This passive monitoring helps in detecting anomalies without affecting network performance.
73
What does Multi Router Traffic Grapher (MRTG) create?
Graphs to show network traffic flows through network interfaces ## Footnote MRTG aids in visualizing traffic patterns.
74
What can MRTG reveal about network traffic?
Abnormal traffic patterns that require further investigation ## Footnote Identifying abnormal patterns is crucial for maintaining network security.
75
What is one use of network sniffers in incident response?
To investigate potential malicious activities, such as data exfiltration ## Footnote This is based on abnormal traffic patterns identified by MRTG.
76
What actions can be taken upon identifying suspicious activities in network traffic?
Instant response and cleanup actions ## Footnote These actions are essential for maintaining network health and security.
77
What does Multi Router Traffic Grapher (MRTG) create?
Graphs to show network traffic flows through network interfaces ## Footnote MRTG aids in visualizing traffic patterns.
78
What can MRTG reveal about network traffic?
Abnormal traffic patterns that require further investigation ## Footnote Identifying abnormal patterns is crucial for maintaining network security.
79
What is one use of network sniffers in incident response?
To investigate potential malicious activities, such as data exfiltration ## Footnote This is based on abnormal traffic patterns identified by MRTG.
80
What actions can be taken upon identifying suspicious activities in network traffic?
Instant response and cleanup actions ## Footnote These actions are essential for maintaining network health and security.
81
SYSLOG 7 LEVELS EXAM
● 0 – Emergency ○ The system has become unstable ○ Most severe ● 1 – Alert ○ A condition should be corrected immediately ● 2 – Critical ○ A failure in the system’s primary application requires immediate attention ● 3 – Error ○ Something is preventing proper system function ● 4 – Warning ○ An error will occur if action is not taken soon ● 5 – Notice ○ The events are unusual ● 6 – Information ○ Normal operational message that requires no action ● 7 – Debugging ○ Useful information for developers ○ Least severe

Network+ (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions