200-201 Question 154

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose BD1

  Correct answers: BD. Network profiling is the process of analyzing network behavior to establish a baseline of "normal" activity. This allows security teams to identify anomalies that may indicate a breach or performance issue. - B. total throughput: This measures the volume of data passing through the network over time. Establishing a baseline for throughput helps identify unusual spikes that could indicate data exfiltration or a DDoS attack. -D. listening ports: Identifying which ports are open and responding to traffic across the network is a fundamental part of profiling. Unexpected changes in listening ports can signal unauthorized services or a "backdoor" created by an attacker

• Chose DE1

  If you google the question you get the answers OS fingerprint and listening ports, which does make more sense to me

• 1

  A-D: The two elements used to profile a network are total throughput and listening ports. Total throughput is the amount of data sent or received over a network in a given period of time. This can be used to identify unusual traffic patterns, such as a sudden increase in traffic to a particular server. Listening ports are the ports on a device that are open and listening for incoming connections. It can be used to identify the applications running on a device and the services available.