2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team is investigating a breach that occurred over a weekend. The team has a SIEM that collects logs from various sources, but the SIEM's storage was full and it stopped ingesting logs on Saturday afternoon. The team also has NetFlow data from the router, but the flow exporter was down for maintenance on Sunday. The team needs to determine what happened on Sunday. What is the best approach?

   • ACheck if any other log sources, such as endpoint logs or cloud logs, are available for the period.
   • BAccept that the data is lost and focus on preventing future incidents.
   • CUse packet capture on the core switch to replay the traffic from Sunday.
   • DUse the NetFlow data from the router, if available, to reconstruct the network activity.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A network analyst is using NetFlow to investigate a potential command-and-control communication. The analyst notices that the flow records show only the first 100 packets of each flow. What limitation of the traffic analysis tool is the analyst experiencing?

   • AEncrypted traffic limitations, because the flow data is encrypted and cannot be decoded.
   • BLack of deep packet inspection, because flow records do not contain payload data.
   • CFlow export limitations, because the router is configured to export only the first N packets of each flow.
   • DSampling inaccuracies, because the router is configured to sample only a subset of packets.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A network analyst needs to capture packets on a high-traffic link to troubleshoot a performance issue. Which tool is specifically designed for packet capture and can save raw packets to a file for later analysis?

   • ASyslog
   • BSNMP
   • CNetFlow
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A network administrator is using NetFlow to monitor bandwidth usage on a WAN link. The administrator notices that the top talkers report does not match the actual bandwidth usage shown by the router's interface counters. What is the most likely reason for this discrepancy?

   • ANetFlow sampling is causing the reported traffic volume to be lower than the actual traffic.
   • BNetFlow does not count traffic that is destined to the router itself.
   • CNetFlow reports traffic in bits per second, while the interface counters report bytes per second.
   • DNetFlow only counts TCP traffic, not UDP traffic.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst wants to identify which internal hosts are generating the most traffic to external destinations over the last 24 hours. The analyst has access to NetFlow data from the border router. Which tool is best suited for this task?

   • AA flow analysis tool that can aggregate NetFlow records by source IP and destination.
   • BA packet capture tool that captures all traffic on the border router.
   • CA SIEM tool that only ingests firewall deny logs.
   • DA network log analysis tool that ingests syslog from the border router.
   Reveal Solution Discussion Select an answer first