200-201 Question 365
Select 4A network security analyst is tasked with creating a network profile to better understand the organization's traffic patterns and detect anomalies. Which of the following elements should the analyst include in the network profile?
- A
Device IP addressing and MAC addresses
- B
Normal traffic patterns and protocols used
- C
Employee work schedules and personal details
- D
Geographic locations of external connections
- E
Open ports and associated services on devices
- F
Employee social media activity
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Network profiling involves collecting and analyzing data about devices, traffic patterns, and external connections to create a baseline of expected network behavior. This baseline is essential for detecting deviations that may indicate security incidents. Relevant elements include IP and MAC addresses, traffic patterns, geographic locations of connections, and open ports and services. Irrelevant elements, such as employee personal details or social media activity, do not contribute to network profiling and should not be included.
- A. Correct.
Device IP addressing and MAC addresses are critical for identifying devices on the network and tracking their activity over time, which is essential for network profiling.
- B. Correct.
Normal traffic patterns and protocols used help establish a baseline of expected behavior, making it easier to identify anomalous or malicious activity.
- C. Incorrect.
Employee work schedules and personal details are not relevant to network profiling, as this information is unrelated to network behavior or security.
- D. Correct.
Geographic locations of external connections are important for identifying where traffic is coming from and determining if it is expected or potentially malicious.
- E. Correct.
Open ports and associated services on devices are key components of network profiling, as they help identify possible vulnerabilities and expected service usage.
- F. Incorrect.
Employee social media activity is unrelated to network profiling and should not be included in this context, as it does not pertain to network traffic or device behavior.