2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst is using NetFlow to investigate a potential data exfiltration. The analyst sees a flow to an external IP with a high byte count, but the flow duration is very short. The analyst suspects the byte count may be inaccurate. Which factor is most likely to cause the byte count to be inaccurate?

   • AThe flow analysis tool rounded the byte count to the nearest megabyte.
   • BNetFlow sampling on the router caused some packets to be missed.
   • CThe router's NetFlow cache was full and some flows were dropped.
   • DThe flow was exported before it ended, so the byte count is incomplete.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team must investigate a suspected data exfiltration that occurred over a 10 Gbps internet link. The team has a capture appliance with 8 TB of storage and a 10 Gbps NIC. The exfiltration is believed to have used HTTPS to a single external IP. The team needs to preserve evidence for potential legal action. Which approach best balances completeness and feasibility?

   • AUse NetFlow records instead of packet capture to document the exfiltration.
   • BUse a SPAN port on the router and capture only the first 100 bytes of each packet.
   • CCapture all traffic on the link without filters and store it for the entire period.
   • DCapture all traffic to the external IP using a capture filter, storing full packets for the entire period.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team is using NetFlow to detect large data transfers to an external IP. The team notices that some large transfers are not appearing in the flow data. Which limitation of traffic analysis tools is most likely responsible?

   • ANetFlow does not include the destination IP address.
   • BNetFlow only records traffic that is blocked by the firewall.
   • CNetFlow sampling may have missed the packets that made up the transfer.
   • DNetFlow cannot record UDP traffic.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is correlating VPN login events with firewall logs to investigate an intrusion. The analyst notices that events that should have occurred at the same time appear to be out of order. Which limitation of network log analysis tools is most likely causing this issue?

   • AThe log analysis tool is using sampling to reduce the log volume.
   • BThe log analysis tool does not support the VPN appliance's log format.
   • CTime synchronization issues between the VPN appliance and the firewall.
   • DThe firewall logs are incomplete because the firewall dropped packets.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network analyst is using NetFlow to investigate a possible data exfiltration. The analyst notices that the flow records show only a fraction of the traffic that the firewall logs indicate. What is the most likely cause of this discrepancy?

   • AThe firewall logs are inaccurate because they do not capture all traffic.
   • BThe firewall is blocking traffic that NetFlow is not seeing.
   • CThe NetFlow exporter is configured with a sampling rate, so only a subset of packets is sampled.
   • DThe NetFlow collector is not receiving all exported flows due to network congestion.
   Reveal Solution Discussion Select an answer first