4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A network administrator needs to monitor overall network utilization and identify the top talkers (hosts generating the most traffic) on a campus network. The administrator does not need to inspect packet contents. Which tool should be used?

   • AEnable NetFlow on the routers and analyze flow records
   • BUse SPAN to mirror traffic to a packet analyzer
   • CConfigure SNMP to poll interface counters
   • DDeploy a TAP on the core switch and capture full packets
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An organization needs to monitor both internal and external traffic for a compliance requirement. They have a limited budget and cannot afford high-capacity storage. They also need to be able to reconstruct the exact sequence of packets for a specific incident if it occurs. Which strategy best meets these conflicting needs?

   • AUse only NetFlow and rely on it for packet reconstruction
   • BUse full packet capture for all traffic continuously
   • CUse SPAN ports to capture all traffic to a single server
   • DUse NetFlow for continuous monitoring and enable full packet capture only for suspicious traffic
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What can a full packet capture from a TAP reveal that NetFlow data cannot?

   • AThe total number of bytes transferred in a flow
   • BThe exact content of an application payload
   • CThe source and destination IP addresses of a flow
   • DThe start and end timestamps of a flow
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An organization is deploying a new security monitoring system. The system must detect command-and-control (C2) traffic patterns across the entire network, but the organization cannot afford to store full packet captures for more than 7 days. Which approach would best meet the detection requirement while respecting the storage constraint?

   • AUse NetFlow to monitor for C2 patterns and retain full packet captures for only 7 days
   • BUse only full packet capture with a 7-day retention
   • CUse SPAN with a 30-day retention
   • DUse NetFlow only, because it can detect all C2 patterns
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is evaluating a monitoring solution for a regulated environment. The solution must provide evidence of all network connections to a payment system, including the ability to prove that no unauthorized payload was transmitted. The team has a choice between a TAP with full packet capture and NetFlow. Which solution should they choose, considering both the regulatory requirement and operational practicality?

   • ATAP with full packet capture, because it provides payload evidence
   • BSPAN with sampling, because it reduces storage while capturing some payload
   • CNetFlow, because it provides a complete record of all connections with minimal storage
   • DNetFlow with application identification, because it identifies the application protocol
   Reveal Solution Discussion Select an answer first