Question bank
Arista Network Detection & Response Specialist
42 Arista Network Detection & Response Specialist questions with the correct answer and a written explanation, organised across 6 exam domains.
- 42 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Arista NDR Platform Architecture
8 questions in this domain
- Question 1Single Choice
Which types of sensor are available for the Arista NDR platform?
- APhysical appliances only
- BVirtual appliances only
- CBoth physical and virtual appliancesCorrect answer
- DCloud-native containers only
Why this is the answer
The document states that sensors are available as physical hardware and virtual machines (VMware, KVM, AMI).
- Question 2Multiple Select
Which two methods can supply network traffic to an Awake Security appliance?
- ASPAN ports on switchesCorrect answer
- BNetwork TAPsCorrect answer
- CNetFlow exports
- Dsyslog messages
Why this is the answer
The document specifies that the appliance receives traffic via SPAN or TAP. NetFlow and syslog are not traffic feeds.
- Question 3Interactive
Based on the cluster status output, what is the minimum number of nodes needed for quorum?
- A1
- B2Correct answer
- C3
- D4
Why this is the answer
With a three-node cluster using Raft consensus, quorum requires a majority (2 out of 3).
- Question 4Single Choice
How does an Arista NDR virtual sensor in AWS receive network traffic?
- AVPC Flow Logs
- BVPC Traffic MirroringCorrect answer
- CAWS CloudTrail
- DDirect Connect
Why this is the answer
The document explains that VPC Traffic Mirroring (packet mirroring) is used to send full packets to the sensor.
- Question 5Multiple Select
Which two statements about Awake Security appliance license activation are correct?
- AThe license is uploaded via the web interface after initial console setup.Correct answer
- BThe license can be applied using the CLI during initial configuration.
- CThe license is tied to the appliance serial number.Correct answer
- DThe license is shared across all appliances without individual activation.
Why this is the answer
The document states licenses are uploaded via web UI and tied to the appliance serial number.
- Question 6Interactive
Examine the firewall rule. What TCP port is used for sensor-to-collector communication?
- A443
- B5555Correct answer
- C514
- D25
Why this is the answer
The document specifies that sensors stream metadata to collectors over TCP port 5555.
- Question 7Single Choice
In an active-active sensor group, what is required to ensure zero packet loss during a sensor failure?
- AA single traffic feed to the primary sensor only
- BDuplicate traffic streams sent to both sensorsCorrect answer
- CAutomated failover with state replication
- DThe passive sensor maintains a hot standby
Why this is the answer
Active-active requires duplicate traffic feeds so both sensors process the same data independently.
- Question 8Multiple Select
Which two tasks are part of the initial deployment process for an Awake Security appliance?
- ARack and power the physical applianceCorrect answer
- BConnect monitoring ports to the SPAN first
- CSet management IP via the serial consoleCorrect answer
- DUpload license immediately via CLI
Why this is the answer
The deployment process starts with rack/power, then console setup for management IP. Monitoring ports are connected later.
Investigation & Forensics
8 questions in this domain
- Question 9Single Choice
What does full session recording in Arista NDR capture?
- AEntire packet headers and payloadsCorrect answer
- BOnly flow summaries
- COnly metadata
- DOnly alerts
Why this is the answer
Full session recording stores the entire packet, including headers and payload, enabling deep inspection.
- Question 10Multiple Select
Which of the following are considered entities in Arista NDR?
- ADevicesCorrect answer
- BUsersCorrect answer
- CFlowsCorrect answer
- DAlerts
Why this is the answer
Entities include devices, users, and flows; alerts are events triggered by detection.
- Question 11Interactive
Based on the session record, which protocol was used?
- ATCPCorrect answer
- BUDP
- CICMP
- DHTTP
Why this is the answer
The protocol field in the session record indicates TCP.
- Question 12Single Choice
What is the first step in timeline analysis for root cause identification?
- AIsolate the incident windowCorrect answer
- BBlock the external IP
- CExport all PCAP
- DEscalate to management
Why this is the answer
The first step is to set a time window around the alert to capture pre-exploitation activities.
- Question 13Multiple Select
Which components are essential for a valid chain of custody in Arista NDR?
- ASHA-256 hashCorrect answer
- BTimestamp of exportCorrect answer
- CExporter's usernameCorrect answer
- DEncryption key
Why this is the answer
Hash, timestamp, and user identity are required; encryption key is separate.
- Question 14Interactive
Which flags in this ndr export command ensure integrity and security?
- A--hashCorrect answer
- B--encryptCorrect answer
- C--start
- D--output
Why this is the answer
--hash adds integrity verification, --encrypt provides confidentiality.
- Question 15Single Choice
What indicates an oversubscribed Arista NDR sensor?
- ASustained incrementing drop counterCorrect answer
- BHigh CPU on sensor
- CFull SSD storage
- DIncreased alert count
Why this is the answer
Sustained drops in the drop counter mean the ring buffer is overflowing, indicating oversubscription.
- Question 16Multiple Select
In DHCP environments, which identifiers can reliably track a device across IP changes?
- AMAC addressCorrect answer
- BHostname
- CAgent IDCorrect answer
- DIP address
Why this is the answer
MAC address and agent ID persist; hostname may change, IP changes.
Network Detection & Response Fundamentals
7 questions in this domain
- Question 17Single Choice
What is a key advantage of Arista NDR over a traditional NIDS?
- AReal-time signature updates
- BDetects encrypted threats without decryptionCorrect answer
- CAggregates logs from endpoints
- DRequires deep packet inspection
Why this is the answer
Arista NDR uses metadata analysis to identify threats in encrypted traffic, unlike NIDS which requires decryption.
- Question 18Multiple Select
Which two capabilities are unique to Arista NDR compared to a SIEM?
- ABehavioral analytics on network metadataCorrect answer
- BCorrelates logs from multiple sources
- CLateral movement detection via east-west trafficCorrect answer
- DLong-term log storage for compliance
Why this is the answer
Arista NDR uses behavioral analytics and focuses on east-west traffic; SIEM correlates logs but lacks network metadata context.
- Question 19Interactive
Which protocol is used for NetFlow export in this configuration?
- AudpCorrect answer
- Btcp
- Csctp
- Dhttp
Why this is the answer
NetFlow export traditionally uses UDP as the transport protocol for flow records.
- Question 20Single Choice
What standardized format does Arista NDR use for threat intelligence exchange?
- ASTIXCorrect answer
- BPDF
- CCSV
- DXML
Why this is the answer
STIX (Structured Threat Information Expression) is the standard format for describing threat data.
- Question 21Multiple Select
Which two compliance regulations require retention of security logs for at least one year?
- AGDPR
- BPCI DSSCorrect answer
- CSOX
- DHIPAACorrect answer
Why this is the answer
PCI DSS requires one year retention for audit trails; HIPAA mandates six years for access logs.
- Question 22Interactive
What is the typical polling interval for a TAXII feed in Arista NDR?
- A15 minutesCorrect answer
- B5 minutes
- C60 minutes
- D1440 minutes
Why this is the answer
The Arista NDR TAXII client typically polls every 15 minutes for updated intelligence.
- Question 23Single Choice
Which telemetry type allows Arista NDR to detect threats in encrypted traffic?
- ANetFlow
- BMetadataCorrect answer
- CFull packet capture
- DSyslog
Why this is the answer
Metadata includes TLS handshake fields like SNI and JA3, enabling encrypted threat detection without decryption.
Operational Management
2 questions in this domain
- Question 24Single Choice
Which of the following best describes the primary purpose of a dashboard in the Arista NDR platform?
- ATo store raw packet captures for forensic analysis
- BTo serve as the primary decision-support tool for triage, investigation, and executive reportingCorrect answer
- CTo completely automate the incident response process
- DTo display the total number of alerts without any contextual information
Why this is the answer
According to the document, 'A dashboard is not merely a collection of charts; it serves as the primary decision-support tool for triage, investigation, and executive reporting.' The other options either describe storage, automation, or lack of context, which do not match the stated purpose.
- Question 25Multiple Select
Which of the following are required before performing an upgrade of the Arista NDR system? (Select all that apply.)
- AVerify cluster health status and that all nodes are in a green stateCorrect answer
- BTake a full system backup of configuration databases and sensor certificatesCorrect answer
- CDisable all detection rules and machine learning models
- DEnsure sufficient disk space is available on the management nodeCorrect answer
Why this is the answer
The document lists pre-upgrade requirements: verifying cluster health, performing a full backup, and checking disk space. Disabling detection rules is not mentioned as a required step; in fact, upgrades should be planned to minimize disruption to detection coverage.
Response & Automation
7 questions in this domain
- Question 26Single Choice
What is the primary purpose of a playbook in the Arista NDR platform?
- ATo detect network anomalies in real time
- BTo automate a sequence of response actions triggered by security eventsCorrect answer
- CTo store historical network traffic data for compliance
- DTo configure firewall rules manually
Why this is the answer
A playbook is a condition-driven automation workflow that orchestrates response actions after a detection trigger, bridging detection and remediation.
- Question 27Multiple Select
Which of the following are valid trigger types for an Arista NDR playbook?
- AEvent-driven (alert-based)Correct answer
- BTime-driven (scheduled)Correct answer
- CManual-only (user invoked)
- DTraffic volume threshold
Why this is the answer
Playbooks can be triggered either from a detection alert (event-driven) or on a schedule (time-driven). Manual invocation is not a native trigger type.
- Question 28Interactive
Examine the syslog configuration snippet. Which default port is used for sending Arista NDR alerts to a SIEM?
- A514Correct answer
- B443
- C161
- D22
Why this is the answer
Syslog messages are sent on UDP/TCP port 514 by default. Port 443 is HTTPS, 161 is SNMP, 22 is SSH.
- Question 29Single Choice
What distinguishes a quarantine action from a block action in Arista NDR?
- AQuarantine blocks all traffic; block only blocks specific ports
- BQuarantine restricts communication to essential services; block stops all traffic to a destinationCorrect answer
- CQuarantine is permanent; block is temporary
- DQuarantine applies at Layer 7; block at Layer 3
Why this is the answer
Quarantine intelligently limits traffic to only allowed services (e.g., AD, patching) while blocking stops all traffic to a specific destination or direction.
- Question 30Multiple Select
Which identifiers can Arista NDR use to contain a host in a quarantine workflow?
- AIP addressCorrect answer
- BMAC addressCorrect answer
- CHostname
- DUser identity (Active Directory username)Correct answer
Why this is the answer
Arista NDR supports containment by IP, MAC, and user identity. Hostname is not a native containment identifier.
- Question 31Interactive
Review the report configuration snippet. For which stakeholder is this report most appropriate?
- ASOC Analyst
- BCISO / ExecutiveCorrect answer
- CNetwork Administrator
- DLegal Team
Why this is the answer
The report focuses on risk trends and incident count with plain language summary, typical for executive audiences. SOC analysts need real-time dashboards.
- Question 32Single Choice
What is the primary purpose of Role-Based Access Control (RBAC) in Arista NDR reporting?
- ATo allow any user to export reports in any format
- BTo ensure that sensitive report data is only visible to authorized personnelCorrect answer
- CTo speed up report generation time
- DTo automatically delete old reports after 30 days
Why this is the answer
RBAC restricts report visibility based on user roles, preventing unauthorized access to sensitive information like raw packet details.
Threat Detection & Analytics
10 questions in this domain
- Question 33Single Choice
What is the primary purpose of behavioral analytics in Arista NDR?
- ADetect known threats by exact signature matching
- BEstablish normal behavior and flag anomaliesCorrect answer
- CReplace all signature-based detection methods
- DAutomatically block all traffic from unknown sources
Why this is the answer
Behavioral analytics establishes a baseline of normal activity and flags deviations, unlike signature-based detection.
- Question 34Multiple Select
Which two statements are true about unsupervised learning in Arista NDR?
- ARequires labeled training data
- BEffective for zero-day attack discoveryCorrect answer
- CGroups similar behaviors into clustersCorrect answer
- DUsed exclusively for known malware classification
Why this is the answer
Unsupervised learning does not use labels; it clusters similar behaviors and is effective for novel attacks.
- Question 35Interactive
In the provided rule snippet, what type of detection is being implemented?
- ASignature-based detection
- BBehavioral anomaly detectionCorrect answer
- CIoC exact match
- DThreshold-based correlation
Why this is the answer
The rule uses a baseline deviation score, which is characteristic of behavioral anomaly detection.
- Question 36Single Choice
What is the first step in the alert triage and false positive tuning workflow in Arista NDR?
- AImmediately whitelist the source IP
- BReview alert metadata to confirm the alert validityCorrect answer
- CAdjust the detection model sensitivity
- DCreate a new detection rule for the behavior
Why this is the answer
Initial triage requires reviewing alert metadata to confirm if it is a true or false positive.
- Question 37Multiple Select
Which two methods are part of false positive tuning in Arista NDR?
- ACreating whitelist exceptions for known benign trafficCorrect answer
- BDisabling all machine learning models permanently
- CAdjusting detection rule thresholds and exclusionsCorrect answer
- DIgnoring all alerts from a specific subnet
Why this is the answer
Whitelisting and rule adjustment are proper tuning methods; disabling models or ignoring subnets are too broad.
- Question 38Interactive
The code shows a configuration snippet from Arista NDR. What does this configuration achieve?
- AEnables exact match IoC detection
- BCreates a time-based exception for a specific IPCorrect answer
- CIncreases the baseline learning window
- DConfigures a new threat intelligence feed
Why this is the answer
The configuration sets a schedule-based whitelist, which is a time-based exception for false positive tuning.
- Question 39Single Choice
Which type of matching does Arista NDR use for file hashes in IoC detection?
- AFuzzy matching with Levenshtein distance
- BExact match onlyCorrect answer
- CCIDR proximity matching
- DRegex pattern matching
Why this is the answer
File hashes require an exact byte-for-byte match; fuzzy matching is not applicable to hashes.
- Question 40Multiple Select
Which two factors influence the final severity of an IoC-generated alert in Arista NDR?
- AIndicator confidence and feed reliabilityCorrect answer
- BThe age of the threat intelligence feed only
- CAsset criticality and risk profileCorrect answer
- DThe number of open source feeds enabled
Why this is the answer
Severity combines indicator confidence and asset risk; feed age alone is not a factor.
- Question 41Interactive
The code block contains a custom detection rule. What type of rule is this?
- ASingle-event rule
- BThreshold rule with sliding windowCorrect answer
- CBehavioral baseline rule
- DIoC static match rule
Why this is the answer
The rule uses a count > 5 within a time window, which defines a threshold rule.
- Question 42Single Choice
What is the recommended initial mode for a new custom detection rule in Arista NDR?
- ABlock and alert
- BAlert onlyCorrect answer
- CSilent mode (no alert)
- DAlert with automated remediation
Why this is the answer
New rules should start in alert-only mode to monitor false positives before enabling blocking.
Frequently asked questions
Everything about the Arista Network Detection & Response Specialist question bank and how to use it.