4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is a key characteristic of NetFlow data compared to full packet capture?

   • ANetFlow records include the full content of each packet.
   • BNetFlow records contain metadata about flows, not the actual payload content.
   • CNetFlow records are generated only when a flow is terminated.
   • DNetFlow records are stored in a proprietary format that cannot be exported.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A network engineer needs to capture traffic on a 1 Gbps full-duplex link to analyze a suspected malware infection. The switch supports SPAN and the engineer has access to a TAP. The engineer wants to ensure that both directions of the conversation are captured without dropping frames during peak utilization. Which approach should the engineer choose?

   • AUse NetFlow export from the switch to collect flow records
   • BConfigure a SPAN session on the switch to monitor the link
   • CDeploy an inline network TAP on the link
   • DEnable port mirroring on the router's WAN interface
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security team is planning to capture traffic on a high-throughput data center link for forensic analysis. They have a limited budget for storage and processing. The team needs to retain data for 90 days and be able to reconstruct the exact sequence of packets for a specific incident. Which approach best balances the storage constraint with the forensic requirement?

   • AConfigure NetFlow with sampling to reduce data volume
   • BEnable NetFlow and store only flow records
   • CUse SPAN to capture only the first 100 bytes of each packet
   • DDeploy a TAP and capture full packets, then compress the capture files
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is investigating a potential command-and-control (C2) communication. The analyst needs to identify which internal hosts are communicating with a known C2 server and how much data is being transferred, but does not need to see the actual commands. Which data source is most efficient for this investigation?

   • ADHCP logs
   • BNetFlow records
   • CSPAN port mirroring
   • DFull packet capture from a TAP
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A network engineer is asked to provide evidence of a security breach that involved malformed Ethernet frames and a half-open connection. The analyst needs to see the exact frames, including any CRC errors, to prove the attack. The switch is heavily loaded and SPAN is available, but the engineer is concerned about dropped frames. Which data source should be chosen?

   • ASNMP interface counters
   • BNetwork TAP inserted on the link
   • CSPAN port mirroring the relevant VLAN
   • DNetFlow records from the switch
   Reveal Solution Discussion Select an answer first