300-215 Question 2
Single answerYou are tasked with investigating a potential security incident in your organization's network. To begin, you decide to collect and analyze network telemetry data using Cisco Secure Network Analytics. Which of the following best describes the role of network telemetry in forensic analysis and incident response?
- A
It provides a high-level overview of software vulnerabilities in the network.
- B
It captures and stores network traffic packets for deep inspection.
- C
It enables visibility into network behavior by analyzing metadata such as NetFlow, IPFIX, or telemetry data.
- D
It performs automated malware analysis on suspicious files and network traffic.
Show answer and explanation
Correct answer: C
Explanation
Network telemetry is crucial in forensic analysis and incident response as it provides a comprehensive view of network behavior by analyzing metadata such as NetFlow, IPFIX, or telemetry data. Cisco Secure Network Analytics uses this information to detect anomalies, identify potential threats, and assist in incident investigations.
- A. Incorrect.
While important, identifying software vulnerabilities is not the primary role of network telemetry. It is more focused on network behavior and metadata.
- B. Incorrect.
Packet capture and deep inspection are handled by tools like Wireshark or specialized packet capture systems, not network telemetry solutions like Cisco Secure Network Analytics.
- C. Correct.
This is correct. Network telemetry provides visibility into network behavior through metadata such as NetFlow, IPFIX, or telemetry data, which helps identify anomalies and malicious activities.
- D. Incorrect.
Automated malware analysis is a function of tools such as Cisco Threat Grid or AMP, not network telemetry solutions.