nerdexam
CompTIA

CV0-002 · Question #106

An administrator is attempting to troubleshoot an issue between a web server in the DMZ and an internal workstation by reviewing packet captures. Upon inspection, the payloads of the packets are…

The correct answer is A. The administrator has yet to authenticate to the network. If an administrator has not authenticated to a secure network, their packet capture tool might lack the necessary authorization or decryption keys to interpret encrypted or obfuscated payloads, causing them to appear unreadable.

Troubleshooting

Question

An administrator is attempting to troubleshoot an issue between a web server in the DMZ and an internal workstation by reviewing packet captures. Upon inspection, the payloads of the packets are unreadable. Which of the following could be the cause of this issue?

Options

  • AThe administrator has yet to authenticate to the network
  • BThe sniffer is located on an incorrect subnet
  • CA vulnerability scanner has interfered with the packet capture
  • DEnd-to-end encryption is applied on the network

How the community answered

(38 responses)
  • A
    74% (28)
  • B
    5% (2)
  • C
    5% (2)
  • D
    16% (6)

Why each option

If an administrator has not authenticated to a secure network, their packet capture tool might lack the necessary authorization or decryption keys to interpret encrypted or obfuscated payloads, causing them to appear unreadable.

AThe administrator has yet to authenticate to the networkCorrect

In certain secure network environments, an administrator's lack of authentication to the network or a specific monitoring system might prevent the packet capture tool from gaining the necessary privileges or decryption keys to interpret encrypted or obfuscated payloads, rendering them unreadable. This implies that payload visibility is tied to the administrator's authenticated status within the network's security framework.

BThe sniffer is located on an incorrect subnet

While a sniffer on an incorrect subnet might not capture the desired traffic, if packets are captured, their payloads' readability is not typically affected by the sniffer's subnet placement, but rather by encryption or corruption.

CA vulnerability scanner has interfered with the packet capture

A vulnerability scanner interfering with packet capture might affect the completeness or accuracy of the capture data, but it typically would not specifically render the payloads of captured packets unreadable.

DEnd-to-end encryption is applied on the network

While end-to-end encryption directly causes payloads to be unreadable, the question focuses on the administrator's authentication status as the cause. If the problem is due to a lack of administrator authentication, it suggests that decryption would be possible with proper credentials, implying a controllable access issue rather than an immutable encryption barrier that is independent of administrative access.

Concept tested: Network troubleshooting - packet capture payload analysis

Topics

#Packet capture#Troubleshooting#Network security#Authentication

Community Discussion

No community discussion yet for this question.

Full CV0-002 Practice