2.2 Identify the Types of Data Provided by These Technologies 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is experiencing a phishing campaign that uses links to a legitimate website that has been compromised. The email content filter is not blocking the emails because the links are not categorized as malicious. The security team wants to block these emails based on the URL reputation score of the linked website. Which technology should be used to provide the URL reputation data?

   • AEmail content filtering
   • BTCP dump
   • CWeb content filtering
   • DNetFlow
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When examining a tcpdump capture file, which piece of information is considered metadata rather than packet content?

   • AThe destination IP address in the IP header
   • BThe TCP source port
   • CThe timestamp of when the packet was captured
   • DThe payload of an HTTP request
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which data types are typically provided by email content filtering?

   • AURL categories and reputation scores for web requests
   • BFlow records with source and destination IPs and ports
   • CSpam and malware detection results, sender/recipient information, and policy actions
   • DApplication identification and usage statistics
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An incident response team is investigating a malware infection. They need to determine the exact payload of a malicious download and also identify which internal hosts communicated with the command-and-control server over the past week. The team has limited storage and cannot capture full packets for the entire week. Which approach best balances the need for payload details and historical flow data?

   • AUse only a full packet capture on the affected host for the entire week
   • BUse NetFlow records for historical flow data and initiate a targeted TCP dump capture on the affected host for payload details
   • CUse only NetFlow records and infer the payload from flow metadata
   • DUse next-generation firewall logs to reconstruct the payload
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network engineer needs to identify which internal hosts are communicating with a known malicious external IP address. The engineer wants to see the total bytes and packets exchanged per connection, but does not need to inspect the payload content. Which technology provides this data most efficiently?

   • ATCP dump
   • BNetFlow
   • CNext-generation firewall
   • DWeb content filtering
   Reveal Solution Discussion Select an answer first