4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a primary advantage of NetFlow over full packet capture in terms of resource usage?

   • AIt eliminates the need for any storage.
   • BIt provides more detailed payload information.
   • CIt allows longer retention of traffic history with the same storage capacity.
   • DIt requires more processing power to analyze.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator wants to monitor traffic patterns across a large enterprise network to identify which applications are consuming the most bandwidth over a month. The administrator has limited storage and processing resources and does not need to inspect packet contents. Which approach is most appropriate?

   • AEnable NetFlow export on the routers and collect flow records
   • BDeploy full packet capture on all core links
   • CConfigure a TAP on every access switch
   • DUse SPAN ports to mirror all traffic to a single analyzer
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An incident responder is investigating a malware infection that communicates over HTTPS. The responder needs to determine whether the malware is exfiltrating data by analyzing the size and duration of the HTTPS flows. However, the responder also needs to see the actual content of the HTTPS sessions to confirm the exfiltration. Which combination of data sources is most appropriate?

   • ASPAN port mirroring only
   • BOnly full packet capture
   • CNetFlow for flow metadata and full packet capture for payload
   • DOnly NetFlow
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which type of data is typically NOT available from a SPAN port but is available from a network TAP?

   • ATraffic from a specific port on a switch
   • BTraffic that is encrypted
   • CTraffic from multiple VLANs on the same switch
   • DFull-duplex traffic from both directions of a link
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following fields is typically included in a NetFlow record?

   • ASource and destination IP addresses
   • BThe raw packet headers of every packet
   • CThe contents of a TLS certificate
   • DThe full HTTP request body
   Reveal Solution Discussion Select an answer first