4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a data breach and needs to determine whether any sensitive data was transmitted to an external IP address. The analyst has NetFlow records for the past 60 days and a full packet capture for the past 24 hours. The breach may have occurred up to 30 days ago. Which approach is most effective?

   • AUse SPAN to capture historical traffic from the switch
   • BUse NetFlow to reconstruct the payload of the transmitted data
   • CUse only the full packet capture to search for the external IP
   • DUse NetFlow to identify flows to the external IP and then correlate with any available packet captures
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization needs to monitor traffic on a 10 Gbps backbone link for a security analytics platform. The platform requires full payload visibility for intrusion detection, but the organization has limited storage capacity. Which approach would best meet the requirement while managing storage constraints?

   • AUse SPAN with sampling to reduce data volume
   • BEnable NetFlow and rely on flow analysis
   • CDeploy a TAP and capture full packets, then use a rolling buffer
   • DConfigure NetFlow with application recognition
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A network team is troubleshooting a performance issue that may be caused by physical-layer errors on a critical link. They need to capture the actual frames to see if CRC errors are present. The switch has a SPAN port available, but the team is concerned that SPAN might not show physical-layer errors. Which approach should they take?

   • AUse the SPAN port and analyze the captured frames
   • BUse SNMP to poll interface error counters
   • CEnable NetFlow on the link and review flow records
   • DInsert a network TAP on the link and capture from it
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is experiencing a security incident that involves both a network scan and a potential data breach. The analyst needs to identify the scanning pattern (which ports were probed) and also determine if any sensitive data was transmitted. The analyst has access to NetFlow and a TAP. Which approach should be taken?

   • AUse only full packet capture for both tasks
   • BUse only NetFlow for both tasks
   • CUse NetFlow to identify the scan pattern and full packet capture from the TAP to inspect for data exfiltration
   • DUse SPAN port mirroring for both tasks
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst needs to investigate a suspected ARP spoofing attack that occurred on a switch segment. The analyst must capture the actual ARP packets exchanged between two hosts to confirm the attack. The switch supports SPAN and the network has an available TAP. Which data source should the analyst use to ensure the capture includes the full-duplex traffic and any physical-layer errors?

   • AConfigure a SPAN port on the switch to mirror the VLAN traffic
   • BEnable NetFlow export on the switch and analyze flow records
   • CUse the switch's CPU counters to estimate ARP traffic volume
   • DDeploy a network TAP inline between the two hosts and capture from it
   Reveal Solution Discussion Select an answer first