▸case-11 An engineer suggests setting up our network baselining system to accept raw syslog text messages directly from firewalls. What standard flow data export formats should our ingestion pipeline be configured to parse for traffic baselining? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 When generating statistical scores for flow volume anomalies in historical NetFlow data, our developer suggested outputting simple binary flags (is_anomaly: true/false). Which specific statistical score metric should be calculated and included in the JSON report for detected flow anomalies? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 When computing per-host communication baselines, a developer wants to aggregate traffic solely by destination IP address to track web server load. Which host IP field must be profiled to establish individual host behavioral baseline statistics for outbound exfiltration tracking? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 A network operations team wants to identify top-N bandwidth consumers in their IPFIX export dataset. Beyond sorting hosts by total bytes consumed, what specific baseline artifact should be generated to contextualize top talker usage? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 To identify potential beaconing patterns and unusual port usage from IPFIX data, our security tool generates a summary report. What specific file/data format should this baseline report use for automated downstream ingestion? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 In our NetFlow volume distribution metrics, we currently track byte count per hour. What two additional flow metrics must be aggregated alongside bytes to complete the hourly and daily volume distribution profiles? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 We are structuring our Python pipeline step-by-step for NetFlow/IPFIX baseline generation. The team proposed running z-score and IQR anomaly detection directly on raw flows before calculating traffic distributions or host baseline statistics. What is the correct sequence of steps for baseline computation prior to flagging anomalies? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are designing the JSON output schema for an automated network baselining tool analyzing NetFlow v5 exports. The team created fields for total bandwidth, top IP talkers, and anomaly alerts. To evaluate traffic patterns across different working shifts and days of the week, what specific time-based distribution profiles must be included in the JSON report? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 We are writing a Python script to build host traffic baselines from NetFlow v9 CSV exports. Our team lead suggested only calculating the arithmetic mean of total bytes per source IP to keep the statistical model simple. What statistical metrics should we include when building per-source IP baseline profiles for flow traffic? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 We recently exported IPFIX data from our cloud gateway in JSON format covering two weeks of network activity. Could you run an analysis on this dataset to construct normal traffic baselines and catch potential data exfiltration attempts? The output should be a structured JSON report detailing the hourly/daily profile breakdowns, per-host flow and byte averages, statistical outliers identified during the sweep, and the primary bandwidth consumers alongside deviation metrics. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 We suspect an unauthorized host is active on our internal subnet 10.0.0.0/24. What Nmap CLI command line flags should we run to conduct an active TCP SYN scan with OS detection and service versioning across this subnet? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We are developing a flow analysis module to establish normal communication profiles. The module currently aggregates total bytes and packets per hour. To catch unauthorized service usage like unexpected SSH or IRC connections on non-standard channels, what additional distribution dimension must be computed during baselining? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 We are evaluating Python scripts for processing IPFIX exports. A developer claims that calculating traffic volume distributions on an hourly basis is redundant if daily volume distributions are already computed. Why are both hourly and daily traffic volume distributions necessary in a baseline profile? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 An analyst wants to check if a host's current 1-hour traffic volume is anomalous compared to its historical norm. What three statistical measures per source IP must be calculated from historical NetFlow data to establish this host baseline? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 When analyzing historical IPFIX logs to detect traffic volume spikes, we were planning to rely solely on a standard deviation z-score cutoff. However, network traffic skewed by periodic batch transfers often renders z-scores ineffective. What additional non-parametric statistical thresholding method should be applied to detect flow volume anomalies? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 When configuring z-score anomaly detection for NetFlow traffic, an analyst asks whether z-score should be evaluated against raw packet payloads or statistical flow distributions. How should z-scores be applied in the baselining workflow? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 We are writing an exfiltration detection script in Python that evaluates flow volume spikes. The developer suggests using a fixed threshold of 10GB in an hour to trigger exfiltration alerts across all hosts. Why should IQR-based thresholding be used instead of a fixed global byte limit? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-21 We need to configure our Cisco Catalyst switch hardware via CLI to export NetFlow v9 records to an external collector at 192.168.1.50 on UDP port 2055 with a 60-second active timeout. What CLI commands (such as flow record, flow exporter, flow monitor) should be executed on the switch? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 A junior analyst is building a baseline script for NetFlow CSV imports and proposes running the baseline on a 24-hour sample of traffic collected yesterday. Is a 24-hour window sufficient for establishing an operational network baseline, and what is the recommended minimum historical window? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 Our team wants to perform network traffic baselining in Python, but developers are debating using raw standard library loops versus specialized data manipulation libraries. Which libraries should be used for processing historical NetFlow/IPFIX CSV and JSON exports for baseline computations? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 We are building a top-talker profiling routine for IPFIX logs. To detect whether a top talker host is exhibiting abnormal behavior rather than just high volume, what metric should be reported alongside the top talker rankings in the final JSON baseline report? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 We need to analyze historical NetFlow v9 records to establish baseline communication patterns across our network layers. Which dimensions are extracted and profiled during protocol distribution baselining? | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 We captured a full PCAP file containing 500 MB of raw packet payload data during a suspected SQL injection attack against our web application. We need to write Snort or Suricata inspection rules to catch the string 'UNION SELECT' inside HTTP POST request bodies. How should we write the Suricata inspection rule for payload signature matching? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |