2.2 Identify the Types of Data Provided by These Technologies 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An administrator reviews a report showing that 'Facebook' consumed 2 GB of bandwidth over the last hour. Which technology provided this data?

   • ANetFlow
   • BPacket capture
   • CTraditional stateful firewall
   • DApplication visibility and control
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is experiencing a rise in phishing emails. The security team wants to see which emails were quarantined, the sender and recipient addresses, and whether the emails contained malware. Which technology provides this data?

   • AEmail content filtering
   • BWeb content filtering
   • CNext-generation firewall
   • DTCP dump
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A network analyst is investigating a slow network issue. The analyst suspects that a specific application is consuming excessive bandwidth. The analyst has access to NetFlow records and TCP dump captures. Which approach is most effective for identifying the application and its bandwidth usage?

   • AUse TCP dump on the firewall and NetFlow records from the switch
   • BUse only NetFlow records to identify the application
   • CUse NetFlow records to identify top talkers and then use TCP dump on the specific conversation to inspect application-layer data
   • DUse only TCP dump captures for the entire network to identify the application
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is investigating a zero-day exploit that is not detected by the intrusion prevention system. The analyst needs to see the exact packet payloads to understand the exploit, but also needs to know which users were affected. The analyst has access to TCP dump and an NGFW. Which approach provides both packet-level detail and user identity?

   • AUse TCP dump to capture packets and correlate with NGFW logs for user identity
   • BUse NGFW logs for both packet payloads and user identity
   • CUse NGFW logs for packet payloads and TCP dump for user identity
   • DUse TCP dump for both packet payloads and user identity
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating a suspected data exfiltration from a corporate server. The analyst needs to determine which external IP addresses received the most data over the past hour, including byte counts per conversation, without storing full packet payloads. Which data source best satisfies this requirement?

   • AA full packet capture from the server's interface
   • BTraditional stateful firewall session logs
   • CNext-generation firewall application logs
   • DNetFlow records exported from the core switch
   Reveal Solution Discussion Select an answer first