200-201 Question 135
Select 3A cybersecurity analyst is investigating a potential data exfiltration incident. They decide to review session data from a network capture. Which of the following pieces of information is typically included in session data and can help identify unusual activity?
- A
Source and destination IP addresses
- B
Full packet payload content
- C
Session start and end timestamps
- D
Amount of data transferred during the session
- E
Encryption key used for the session
Show answer and explanation
Correct answers: A, C, D
Explanation
Session data is high-level metadata about network communications that helps analysts identify patterns and anomalies. It typically includes information such as source and destination IP addresses, timestamps, and data transfer volumes. These elements are critical for detecting suspicious activity, while detailed payload content or encryption keys fall into different categories of network analysis.
- A. Correct.
Source and destination IP addresses are fundamental elements of session data and are critical for identifying where the communication originated and terminated. This information helps in tracking unusual activity.
- B. Incorrect.
Full packet payload content is not typically part of session data. Instead, session data focuses on metadata about the communication, not the actual content.
- C. Correct.
Session start and end timestamps are part of session data and provide valuable information about the duration and timing of the communication, which can indicate unusual patterns.
- D. Correct.
The amount of data transferred during the session is a key aspect of session data that can help identify anomalies, such as unusually large data transfers during exfiltration attempts.
- E. Incorrect.
Encryption keys are not part of session data. They are part of cryptographic processes and are not typically included in session metadata.