2.4 Describe the Uses of These Data Types in Security Monitoring 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC analyst is trying to detect a slow and low data exfiltration attack that involves small amounts of data being sent over long periods. The analyst has access to session data, statistical data, and alert data. Which data source would be most effective for detecting this type of attack?

   • AAlert data, because the IDS would detect the exfiltration
   • BStatistical data, because it can reveal subtle changes in traffic trends over time
   • CFull packet capture, because it provides the exact data being sent
   • DSession data, because it shows every individual connection
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network security team is planning to implement a new monitoring solution. The team has a limited budget and needs to choose between storing full packet capture for one week or session data for one year. The team's primary goal is to detect anomalies and perform historical analysis of network behavior. Which choice best meets the team's needs?

   • AFull packet capture for one week, because it provides more detail
   • BA combination of both, because it provides the best of both worlds
   • CSession data for one year, because it provides long-term visibility into network conversations
   • DStatistical data for one year, because it is the most cost-effective
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which characteristic is unique to full packet capture compared to other network monitoring data types?

   • AIt generates alerts based on signature matches
   • BIt stores the complete raw network traffic, including payloads
   • CIt summarizes conversations by source and destination IPs
   • DIt provides aggregated byte counts and packet counts
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC analyst wants to establish a baseline of normal network traffic for a critical server to detect anomalies. The analyst needs to know the average packet rate, byte count, and number of connections per hour over the past month. Which data source is best suited for this baseline analysis?

   • AStatistical data from a flow-based monitoring system
   • BAlert data from the IDS
   • CTransaction data from the application logs
   • DFull packet capture from the network tap
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager wants to detect a distributed denial-of-service (DDoS) attack early by monitoring for unusual increases in traffic volume. The team has access to NetFlow data and wants to set up an alert that triggers when traffic exceeds a threshold. Which data type should be used to define the threshold and detect the anomaly?

   • ASession data, such as the number of active flows
   • BFull packet capture of all traffic
   • CAlert data from the IDS
   • DStatistical data, such as average packets per second over the past month
   Reveal Solution Discussion Select an answer first