300-215 Question 3
Single answerDuring a forensic investigation, your team is tasked with identifying unusual network behavior using Cisco Secure Network Analytics (formerly Stealthwatch). Which fundamental capability of Cisco Secure Network Analytics provides the most valuable insight for detecting potential threats in this scenario?
- A
Flow-based network telemetry for monitoring east-west and north-south traffic
- B
Endpoint-based anti-malware scanning and signature matching
- C
Real-time vulnerability scanning of network devices
- D
Centralized policy enforcement for access control
Show answer and explanation
Correct answer: A
Explanation
Cisco Secure Network Analytics is designed to provide visibility into network traffic using flow-based telemetry. This capability is essential for detecting unusual network behavior, as it allows analysts to identify deviations from normal traffic patterns, making it highly effective for forensic investigations and incident response.
- A. Correct.
Cisco Secure Network Analytics uses flow-based network telemetry to monitor traffic patterns, detect anomalies, and identify potential threats in both east-west (internal) and north-south (external) network traffic, making it the most relevant capability for this scenario.
- B. Incorrect.
Endpoint anti-malware scanning and signature matching are not features of Cisco Secure Network Analytics. This capability is typically associated with endpoint protection solutions.
- C. Incorrect.
Real-time vulnerability scanning is not a primary function of Cisco Secure Network Analytics. Vulnerability scanning is usually performed by dedicated tools like Cisco Secure Vulnerability Management.
- D. Incorrect.
Centralized policy enforcement for access control is not a primary feature of Cisco Secure Network Analytics. This capability is more related to Cisco Identity Services Engine (ISE).