CND Practice Question: Incident Detection Response And Threat Prediction
An incident responder is investigating a suspected data exfiltration incident over encrypted channels. Which THREE network artifacts or telemetry sources should the analyst inspect to identify malicious TLS traffic anomalies? (Choose THREE)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server Name Indication (SNI) fields in the TLS Client Hello message
Analyzing TLS traffic involves inspecting certificate validity, JA3/JA3S client fingerprints, and SNI fields.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Plaintext passwords extracted from HTTPS payload bodies
Why it's wrong here
HTTPS payloads are encrypted, so plaintext passwords cannot be extracted directly from the payload.
- ✗
Raw ICMP echo payload strings
Why it's wrong here
ICMP traffic is separate from TLS/HTTPS sessions.
- ✓
Server Name Indication (SNI) fields in the TLS Client Hello message
Why this is correct
The SNI field is sent in plaintext during the TLS handshake, revealing the target domain name.
- ✓
JA3 and JA3S TLS cryptographic handshaking fingerprints
Why this is correct
JA3 fingerprints allow defenders to identify client software and malware families regardless of encryption.
- ✓
X.509 digital certificate metadata (issuer, validity dates, self-signed status)
Why this is correct
Inspecting certificate attributes helps identify anomalous or fraudulent certificates used by C2 servers.
About these practice questions
Courseiva writes every CND question from scratch — 323 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.