4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which type of data provides a more granular view of individual network conversations?

   • ASNMP interface counters
   • BFull packet capture from a TAP
   • CNetFlow records
   • DSyslog messages from routers
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst needs to determine which internal hosts communicated with a known external command-and-control server over the past 30 days, including the total bytes transferred per conversation. The analyst has access to NetFlow records stored on a collector. Which type of analysis is most appropriate?

   • AEnable SPAN on the switch to capture the traffic retroactively
   • BQuery NetFlow records for flows matching the external IP and sum the byte counts
   • CUse a TAP to replay the historical traffic
   • DExtract the full packet capture from the NetFlow records
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A SOC analyst is monitoring a network for signs of a distributed denial-of-service (DDoS) attack. The analyst needs to identify the source IPs generating the most traffic and the duration of each flow, but does not need to inspect the payload. Which data source is best suited for this analysis?

   • AFull packet capture
   • BSyslog from the router
   • CSPAN port mirroring
   • DNetFlow data
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which analysis task is best suited for full packet capture from a TAP?

   • ADetermining the average duration of all flows to a server
   • BIdentifying the top source IP addresses by traffic volume
   • CMonitoring bandwidth utilization on a link over time
   • DExtracting a malicious file from an HTTP session
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A SOC manager must choose a monitoring solution for a 40 Gbps backbone link. The solution must support both long-term traffic trend analysis and deep packet inspection for incident response. The budget allows for either a high-capacity NetFlow collector or a packet capture appliance with limited retention. Which combination of data sources would best meet both requirements?

   • AUse only NetFlow with high sampling rates
   • BUse only a TAP with full packet capture and a 90-day retention
   • CUse SPAN to mirror traffic to both a NetFlow collector and a packet analyzer
   • DUse NetFlow for long-term trends and a TAP with a short rolling buffer for DPI
   Reveal Solution Discussion Select an answer first