200-201 Question 239
Select 3A network administrator is investigating suspicious activity on the company's network. They decide to analyze NetFlow data to identify potential threats. Which of the following pieces of information can the administrator obtain from NetFlow data to help identify malicious activity?
- A
Source and destination IP addresses of the traffic
- B
The content of the payload within the packets
- C
The amount of data transferred between hosts
- D
The timestamps of when the flows started and ended
- E
The exact application layer protocol used by the traffic
Show answer and explanation
Correct answers: A, C, D
Explanation
NetFlow is a network protocol that collects IP traffic information and provides a summary of the data traversing a network. It is instrumental in identifying source and destination IPs, data volumes, and flow timestamps, all of which are valuable for detecting anomalies. However, it does not provide payload content or detailed application layer insights, as it is focused on flow-level metadata rather than packet content.
- A. Correct.
Correct: NetFlow provides details about the source and destination IP addresses, which are critical for tracking the origin and target of traffic on a network.
- B. Incorrect.
Incorrect: NetFlow does not capture payload data. It only provides metadata about the traffic, such as flow characteristics.
- C. Correct.
Correct: NetFlow records the volume of data exchanged, which can help identify unusually large data transfers indicative of exfiltration or other malicious activity.
- D. Correct.
Correct: NetFlow captures timestamps for the start and end of flows, which are useful for identifying patterns and correlating with other logs.
- E. Incorrect.
Incorrect: While NetFlow might indicate the port numbers used, it does not provide detailed application layer protocol information. Additional tools, like packet analyzers, are required for this.