200-201 Question 259
Select 3A cybersecurity analyst is investigating unusual activity on the network. They decide to analyze NetFlow data to determine the source of the issue. Which insights can the analyst gain by reviewing NetFlow data?
- A
The specific payload content of malicious packets
- B
The volume of traffic exchanged between a source and destination over a specific time period
- C
The IP addresses and port numbers involved in the communication
- D
The application-layer data transmitted during the communication
- E
The timing and duration of connections between devices
Show answer and explanation
Correct answers: B, C, E
Explanation
NetFlow provides valuable metadata about network traffic, including source and destination IPs, port numbers, traffic volume, and timing details. This allows analysts to identify communication patterns, detect anomalies, and correlate events without requiring packet payloads or application-layer data. By focusing on flow-level details, NetFlow is an efficient tool for high-level traffic analysis in cybersecurity operations.
- A. Incorrect.
NetFlow does not capture packet payloads, so it cannot reveal the specific content of malicious packets. This requires full packet capture or deep packet inspection.
- B. Correct.
NetFlow provides detailed information about the volume of traffic exchanged, making it useful for analyzing bandwidth usage or detecting anomalies.
- C. Correct.
NetFlow data includes IP addresses and port numbers, which helps in identifying the endpoints involved in the network communication.
- D. Incorrect.
NetFlow does not capture application-layer data, as it focuses on metadata about the traffic rather than the content itself.
- E. Correct.
NetFlow includes timing details such as the start and end times of flows, which can help in understanding the duration and frequency of connections.