200-201 Question 240
Select 4A security analyst is investigating a potential data exfiltration incident in their network. The analyst decides to use NetFlow data to determine which hosts were communicating during the suspected time of the incident. What specific information can the analyst obtain from the NetFlow data to support their investigation?
- A
Source and destination IP addresses of the communication
- B
Payload content of the transmitted packets
- C
Timestamps indicating when the communication occurred
- D
The protocol used for the communication
- E
The amount of data transferred during the communication
Show answer and explanation
Correct answers: A, C, D, E
Explanation
NetFlow is a network protocol used to collect metadata about IP traffic flows. In a cybersecurity investigation, it is a valuable tool for identifying source and destination IP addresses, timestamps, protocols, and data transfer statistics. However, it does not capture the actual packet payloads, which means it cannot provide the content of the communications. This information helps analysts understand the scope, origin, and potential impact of network events, such as data exfiltration.
- A. Correct.
Correct: NetFlow records include source and destination IP addresses, allowing the analyst to identify which devices were involved in the communication.
- B. Incorrect.
Incorrect: NetFlow does not capture or store actual payload content. It only provides metadata about the communication flows.
- C. Correct.
Correct: NetFlow includes timestamps that allow analysts to determine when the communication started and ended.
- D. Correct.
Correct: NetFlow records the protocol used in the communication, such as TCP, UDP, or ICMP, which is essential for understanding the nature of the traffic.
- E. Correct.
Correct: NetFlow provides information about the amount of data transferred, such as bytes and packets, which can indicate the volume of communication.