Network Defense Essentials (NDE) Practice Exam

What type of suspicious traffic signature indicates an attempt to scan for network weaknesses?

1. Unauthorized access

2. Denial of Service

3. Reconnaissance

4. Malware delivery

The correct answer is: Reconnaissance

Reconnaissance traffic signatures are indicative of an attempt to scan for network weaknesses because these activities are designed to gather information about a network's structure, open ports, services running on those ports, and vulnerabilities that could be exploited. During the reconnaissance phase, attackers often use various tools to probe a network and determine which systems can be targeted for further attacks. This behavior is characterized by a high volume of port scanning, service enumeration, and OS fingerprinting, which all aim to map out the network to find entry points or vulnerabilities. The other options reflect different types of unwanted or harmful activity. Unauthorized access typically involves an intruder attempting to breach security measures to gain entry into a network or system after reconnaissance has already taken place. Denial of Service (DoS) attacks aim to disrupt the availability of services by overwhelming systems, while malware delivery focuses on distributing malicious software to compromise systems. All of these activities follow the reconnaissance stage, which is why identifying reconnaissance traffic is crucial as a first step in network defense.