200-201 Question 101
Select 3A cybersecurity analyst is investigating unusual traffic patterns within a corporate network. The analyst decides to use NetFlow to gather further insights. Which of the following pieces of information can be obtained from NetFlow data to assist in the investigation?
- A
The source and destination IP addresses involved in the traffic
- B
The payload content of the packets being transmitted
- C
The amount of data transferred between source and destination
- D
The protocol used for communication (e.g., TCP, UDP)
- E
The geographical location of the source IP address
Show answer and explanation
Correct answers: A, C, D
Explanation
NetFlow is a network protocol designed to collect IP traffic information, such as source and destination IP addresses, protocols used, and data volume. This metadata is invaluable for analyzing traffic patterns and identifying potential anomalies. However, NetFlow does not capture packet payloads or directly provide geographical information, as its primary purpose is traffic analysis, not content inspection or geolocation.
- A. Correct.
Correct: NetFlow provides detailed information about the source and destination IP addresses, which helps identify the endpoints involved in communication.
- B. Incorrect.
Incorrect: NetFlow does not capture packet payload content; it focuses on metadata about the network flow, not the data itself.
- C. Correct.
Correct: NetFlow includes information on the volume of data transferred between a source and destination, enabling insights into traffic patterns.
- D. Correct.
Correct: NetFlow provides protocol-level details such as whether the traffic is TCP, UDP, or other protocols, which is crucial for understanding the type of communication.
- E. Incorrect.
Incorrect: While additional tools can infer geographical locations from IP addresses, NetFlow itself does not provide geographical information.