200-201 Question 140
Select 4A security analyst is investigating a potential data breach involving file transfers. They decide to review metadata from network traffic logs to identify suspicious activity. Which metadata fields would be most helpful in determining if unauthorized file transfers have occurred?
- A
Source IP address
- B
Destination IP address
- C
File hash information
- D
Protocol used
- E
File size
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Metadata provides important details about network traffic without delving into the actual content of the data. In the context of investigating file transfers, looking at metadata like source and destination IPs, protocols, and file sizes can help analysts identify suspicious patterns or unauthorized transfers. File hash information, while useful, is not part of metadata and would not be available in this context.
- A. Correct.
The source IP address indicates the origin of the traffic, which can help identify the system initiating the file transfer and whether it is an authorized entity.
- B. Correct.
The destination IP address shows where the file was sent. If the destination is an untrusted or unexpected location, it may indicate unauthorized activity.
- C. Incorrect.
File hash information is generally part of the payload data, not metadata. Metadata focuses on details such as IPs, protocols, and file sizes.
- D. Correct.
The protocol used is crucial in determining whether a file transfer occurred and which application was used for the transfer (e.g., FTP, HTTP, etc.).
- E. Correct.
The file size is part of the metadata and can help identify whether large files were transferred, which might indicate a data exfiltration attempt.