4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small company has limited storage and processing resources. They need to monitor traffic patterns across their network for a month to identify unusual communication patterns, but they do not need to inspect payloads. Which approach best balances resource usage with the monitoring requirement?

   • ADeploy full packet capture on all network segments
   • BRely on firewall logs only
   • CEnable NetFlow export from routers and store flow records
   • DUse SPAN ports to mirror all traffic to a single analyzer
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is investigating a possible brute-force attack against an SSH server. The analyst wants to identify the source IP addresses that initiated the most connections and the total number of packets sent per source over the last hour. Which data source is best suited for this task?

   • ASPAN port mirroring to a packet analyzer
   • BSyslog logs from the SSH server
   • CNetFlow records from the router
   • DFull packet capture from a TAP
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In which scenario would NetFlow data be more appropriate than full packet capture?

   • AMonitoring overall traffic patterns to identify top talkers
   • BInvestigating the content of a malware download
   • CReconstructing a file transferred over the network
   • DAnalyzing the exact sequence of TCP flags in a connection
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A network team is planning to deploy a monitoring solution for a critical link that carries both production traffic and management traffic. They need to capture all traffic, including any physical-layer errors, but they cannot afford to impact the link's performance. Which deployment method best meets these requirements?

   • AInsert a passive network TAP
   • BUse a packet broker with SPAN aggregation
   • CEnable NetFlow on the router
   • DConfigure a SPAN port on the switch
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC team needs to monitor a high-throughput network for anomalies. They have a limited budget and cannot afford a large storage system. They need to detect unusual traffic patterns, such as sudden spikes in traffic to a specific destination. Which data source is most cost-effective for this purpose?

   • ASPAN port mirroring
   • BFull packet capture
   • CSNMP polling
   • DNetFlow data
   Reveal Solution Discussion Select an answer first