Question 1 of 30
In a corporate network, a security analyst is tasked with analyzing a packet capture (PCAP) file that contains both TCP and UDP traffic. The analyst notices a significant amount of UDP traffic directed towards a specific external IP address. Upon further inspection, the analyst finds that the UDP packets are being sent to port 53, which is typically associated with DNS queries. The analyst suspects that this traffic may be indicative of a DNS tunneling attack. To confirm this hypothesis, the analyst decides to calculate the ratio of UDP packets to TCP packets in the capture. If the PCAP file contains 1,200 UDP packets and 300 TCP packets, what is the ratio of UDP packets to TCP packets, and what does this imply about the nature of the traffic?
The ratio is 4:1, suggesting a potential anomaly in the traffic pattern.
The ratio is 1:4, indicating normal traffic behavior.
The ratio is 2:1, which is typical for standard network operations.
The ratio is 1:2, implying a balanced distribution of traffic types.

Preparing for CISCO 300-215 Conducting Forensic Analysis and Incident Response Using Cisco CyberOps Technologies (CBRFIR)? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free