4.5 Compare the Characteristics of Data Obtained from Taps or Traffic Monitoring and Transactional Data (NetFlow) in the Analysis of Network Traffic 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst needs to identify all internal hosts that communicated with a known malicious IP over the past week. The analyst has access to NetFlow data and full packet capture from a TAP. Which data source should be used first to quickly identify the hosts?

   • ADHCP logs
   • BSPAN port mirroring
   • CFull packet capture
   • DNetFlow data
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   When comparing data obtained from a network TAP versus a SPAN port, which characteristic is unique to a TAP?

   • AIt can be configured remotely to filter traffic based on IP addresses.
   • BIt can only capture traffic that is destined to a specific VLAN.
   • CIt can capture full-duplex traffic without dropping packets during bursts.
   • DIt requires a switch to be configured to copy traffic from a specific port.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC analyst is reviewing network traffic to identify which internal hosts are communicating with a known malicious external IP. The analyst needs to see the volume of traffic (packets and bytes) and the duration of each connection, but does not need the actual content of the communication. Which data source is most appropriate for this task?

   • ASPAN port mirroring to a packet analyzer
   • BSyslog logs from the firewall
   • CFull packet capture from a TAP
   • DNetFlow records exported from the router
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Why does NetFlow require less storage and processing resources compared to full packet capture?

   • ANetFlow compresses the payload of each packet.
   • BNetFlow records contain only metadata summaries, not the full payload of each packet.
   • CNetFlow only captures packets during peak hours.
   • DNetFlow uses a more efficient packet capture mechanism.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security analyst is investigating a zero-day exploit that uses a previously unknown protocol over port 443. The analyst has NetFlow records and a full packet capture from a TAP for the same time period. The analyst needs to determine the exact payload structure of the exploit to create a detection signature. Which data source should the analyst use, and why?

   • ANetFlow records with application identification, because they identify the application
   • BFull packet capture, because it contains the actual payload bytes
   • CNetFlow records, because they include the protocol type and byte counts
   • DSPAN port statistics, because they show packet sizes
   Reveal Solution Discussion Select an answer first