Network Traffic Analysis Questions

Covers the skills and knowledge needed to collect, inspect, and interpret network traffic and packet captures to detect, investigate, and explain normal and malicious behavior. Topics include packet structure and layered headers, key fields such as source and destination internet protocol addresses, ports, protocol identifiers, payload visibility, and timing and volume characteristics. Candidates should understand network flows, session lifecycle, common protocol behaviors, and how encrypted traffic differs from unencrypted traffic in terms of observable metadata. Emphasis is placed on recognizing suspicious patterns such as connections to unusual external addresses, communication on nonstandard ports, anomalous domain name system queries, large or unexpected data transfers consistent with exfiltration, and command and control behavior. Practical skills include using capture and analysis tools such as Wireshark and tcpdump, working with flow data and flow collectors, performing basic deep packet inspection, and leveraging intrusion detection signatures and log evidence. The topic also covers fundamentals of network forensics: extracting and preserving evidence from captures and logs, developing timelines of network activity, and correlating artifacts across sensors to support investigations.