Network+ Network Monitoring and Logging Flashcards

Which port does syslog use by default to receive log messages?

Answer: UDP 514

Syslog traditionally uses UDP port 514 for log transmission, though TCP 514 and TLS variants exist for reliability.

What is the purpose of an OID (Object Identifier) in SNMP?

Answer: Uniquely identifies a specific managed object in the MIB hierarchy

An OID is a unique numeric identifier in a hierarchical tree that maps to a specific manageable object within the MIB.

A security analyst notices a large volume of ICMP echo replies arriving at a host that never sent echo requests. What type of attack is this indicative of?

Answer: Smurf attack

A Smurf attack sends ICMP echo requests to broadcast addresses with a spoofed source IP, causing many hosts to reply to the victim.

Which log analysis technique looks for deviations from the established baseline to identify potential security incidents?

Answer: Anomaly-based detection

Anomaly-based detection compares current behavior against a baseline and flags statistically significant deviations as potential threats.

What does IPFIX stand for, and what is its relationship to NetFlow?

Answer: IP Flow Information Export; the IETF standard based on NetFlow v9

IPFIX (IP Flow Information Export) is the IETF-standardized flow export protocol derived from Cisco NetFlow v9.

An administrator wants to monitor interface statistics without installing software on managed devices. Which approach should be used?

Answer: Agentless monitoring via SNMP

Agentless monitoring uses SNMP or similar protocols to query devices remotely without requiring installed agents.

Which command-line tool can be used on a Windows system to test connectivity and measure round-trip time to a remote host?

Answer: ping

The ping command sends ICMP echo requests to a target host and reports round-trip time and packet loss.