Network traffic analysis in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is network traffic analysis?

Network traffic analysis is the process of capturing, inspecting, and studying data packets moving across a computer network to understand communication patterns and detect issues or threats.

beginner

Name two common tools used for network traffic analysis.

Wireshark and tcpdump are two popular tools used to capture and analyze network traffic.

intermediate

Why is network traffic analysis important in cybersecurity?

It helps detect suspicious activities, identify security breaches, troubleshoot network problems, and ensure data is flowing securely and efficiently.

beginner

What is a packet in network traffic analysis?

A packet is a small unit of data sent over a network. It contains both the information being sent and control information like source and destination addresses.

intermediate

How can encrypted traffic affect network traffic analysis?

Encrypted traffic hides the content of data packets, making it harder to inspect the actual information, but metadata like packet size and timing can still be analyzed.

What is the main purpose of network traffic analysis?

A To monitor and understand data flow in a network

B To create new network protocols

C To increase internet speed

D To design hardware components

Network traffic analysis focuses on monitoring and understanding how data moves through a network.

Which tool is commonly used for capturing network packets?

A Photoshop

B Notepad

C Excel

D Wireshark

Wireshark is a popular tool designed specifically for capturing and analyzing network packets.

What does a network packet typically contain?

A Data and control information like source and destination

B Only the sender's address

C Only the message content

D The entire website code

Packets include both the data being sent and control info such as source and destination addresses.

How does encryption affect network traffic analysis?

A It speeds up packet capture

B It makes all analysis impossible

C It hides packet content but metadata can still be analyzed

D It removes packet headers

Encryption hides the content inside packets, but metadata like size and timing remain visible for analysis.

Which of these is NOT a use of network traffic analysis?

A Detecting security threats

B Designing new programming languages

C Troubleshooting network issues

D Monitoring data flow

Designing programming languages is unrelated to network traffic analysis.

Explain what network traffic analysis is and why it is important in cybersecurity.

Think about how watching data flow helps keep networks safe.

Describe how encryption impacts the process of analyzing network traffic.

Consider what parts of the data are still visible even when encrypted.