Network traffic analysis in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Packet Capture

What is the primary purpose of capturing network packets during traffic analysis?

A To record data packets for later inspection to identify network issues or threats

B To block all incoming network traffic to prevent attacks

C To increase the speed of data transmission across the network

D To encrypt data packets to secure communication

💡 Hint

Think about why analysts need to see the actual data moving through the network.

Capturing packets allows analysts to inspect the contents and metadata of network traffic. This helps identify problems or malicious activity by examining what is actually being sent and received.

📋 Factual

intermediate

Common Protocols in Network Traffic

Which of the following protocols is most commonly analyzed in network traffic to detect web browsing activity?

A FTP (File Transfer Protocol)

B SMTP (Simple Mail Transfer Protocol)

C HTTP (Hypertext Transfer Protocol)

D DNS (Domain Name System)

💡 Hint

Consider which protocol is used when you visit websites.

HTTP is the protocol used for web browsing. Network traffic analysis often focuses on HTTP to understand user web activity and detect suspicious behavior.

🔍 Analysis

advanced

Identifying Anomalous Traffic Patterns

During network traffic analysis, which pattern is most likely to indicate a Distributed Denial of Service (DDoS) attack?

A Regular traffic with normal packet sizes and intervals

B A steady, low volume of traffic from a single IP address

C Encrypted traffic using HTTPS on port 443

D A sudden spike in traffic from many different IP addresses targeting a single server

💡 Hint

Think about what happens when many computers try to overwhelm one server at once.

A DDoS attack involves many sources sending large amounts of traffic to one target to overwhelm it. This causes a sudden spike from multiple IPs.

❓ Comparison

advanced

Passive vs Active Network Traffic Analysis

Which statement best describes the difference between passive and active network traffic analysis?

A Passive analysis observes traffic without interfering; active analysis injects traffic or probes the network

B Passive analysis blocks suspicious traffic; active analysis only logs traffic

C Passive analysis requires user interaction; active analysis runs automatically

D Passive analysis encrypts traffic; active analysis decrypts traffic

💡 Hint

Consider whether the analysis changes the traffic or just watches it.

Passive analysis listens to network traffic without affecting it. Active analysis involves sending test traffic or probes to gather information.

❓ Reasoning

expert

Interpreting Encrypted Traffic in Network Analysis

When most network traffic is encrypted, what is the best approach for a security analyst to still detect suspicious activity?

A Decrypt all traffic using the network's private keys without restrictions

B Analyze metadata such as packet size, timing, and destination IP addresses

C Ignore encrypted traffic since it cannot be analyzed

D Only monitor unencrypted traffic on port 80

💡 Hint

Think about what information is still visible even if the content is hidden.

Even if content is encrypted, metadata like packet size, timing, and destination can reveal patterns of suspicious behavior without decrypting the data.