Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ECC CCE > Network Monitoring, Analysis and Troubleshooting > Flashcards

Network Monitoring, Analysis and Troubleshooting Flashcards

1
Q

Typical network issues?

A
  • physical connection
  • connectivity
  • configuration (ex. DNS)
  • software
  • traffic overload
  • network IP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When does the Destination Unreachable occur?

A

If datagram cannot be forwarded to its destination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

When does the Time Exceeded occur?

A

When TTL expires/is decremented to 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why could IP Parameter Problem occur?

A

Datagram could not be forwarded due to some type of error in the header.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Is IP Parameter Problem messaged because of the destination host or network?

A

No, the cause is an error that prevents the datagram from being processed and delivered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What ICMP type isIP Parameter Problem

A

Type 12

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is ICMP Type 3?

A

Destination unreachable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is ICMP Control Message?

A
  • not a result of lost packet or error conditions
  • informs hosts of conditions: network congestion, existence of better gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is ICMP Type 5?

A

Redirect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is one of the less obvious potential solution to network issues?

A

Change the Ethernet Adapter’s Duplex Settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Different steps to troubleshoot physical connectivity issues

A
  • Cable connectivity
  • Faulty ports
  • Traffic overload
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What tool can be used to troubleshoot routing problems?

A

traceroute

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How does traceroute works?

A

Sends sequential packets with incremental TTL, logs the routers along the way - helps determine faulty node.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What nslookup is used for?

A

Lookup a specific IP address or multiple IP addresses associated with a domain name as a time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which tool would you use to display both incoming and outgoing TCP/IP traffic?

A

netstat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What tool would you use when traceroute doesn’t show any issues, and you suspect that one of the routers fails nondeterministic?

A

pathping

17
Q

What are hping2/hping3 used for?

A

Network scanning and packet crafting.

18
Q

What dig is used for?

A

(on -nix systems) query DNS servers and retrieve information about host addresses, name servers and mail exchanges.

19
Q

How to capture network traffic?

A

tcpdump

20
Q

ARP

A

Address Resolution Protocol

21
Q

What is network monitoring?

A

A Retrospective security approach that involves monitoring the network for abnormal activities.

22
Q

What is a network traffic signature?

A

Set of traffic characteristics such as IP address, ports, TCP flags, packet length, TTL and protocols

23
Q

Explain informational suspicious traffic signature.

A

Traffic behaves abnormally, but might not be malicious

24
Q

Explain reconnaissance suspicious traffic signature.

A

Traffic contains signatures that indicate an attempt to gain information

25
Q

What are different attack signature analysis techniques?

A
  • Content-based (packet payload)
  • Context-based (packet headers)
  • Atomic-signature-based (single packet is sufficient to detect attack signature)
  • Composite-signature-based (multiple)
26
Q

What are the important characteristics of logging that should be aimed for?

A
  • timestamp synchronization of all sources
  • prevent unauthorized access
  • manageble and auditable
27
Q

What are the three primary event log types on Windows?

A
  • Application
  • Security
  • System
28
Q

What are the available types of events on Windows?

A
  • Error
  • Warning
  • Information
  • Success Audit
  • Failure Audit
29
Q

What is called the software that produces logs for the Linux system?

A

syslogd

30
Q

Where in Linux, by default, all logs are stored?

A

/var/log/

31
Q

What are the different severity levels of Linux logs?

A

Emergency, alert, critical, error, warning, notice, info and debug. Numbered from 0 to 7.

32
Q

What are the characteristics of syslog protocol?

A
  • runs on UDP 514
  • Windows has no native syslog tool

ECC CCE (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions