300-215 Question 63
Single answerDuring an investigation of a suspected data breach, you are tasked with analyzing network traffic using Cisco Secure Network Analytics (formerly Stealthwatch). Which forensic technique should you prioritize to identify malicious activity and determine the source of the breach?
- A
Performing a NetFlow analysis to identify anomalous traffic patterns.
- B
Conducting a memory dump of the suspected compromised endpoint.
- C
Utilizing endpoint detection and response (EDR) tools to analyze file changes.
- D
Reviewing DNS logs to detect unauthorized domain connections.
Show answer and explanation
Correct answer: A
Explanation
Cisco Secure Network Analytics (formerly Stealthwatch) is specifically designed for network traffic analysis. Leveraging NetFlow data allows investigators to identify unusual traffic patterns, detect lateral movement, and trace the source of malicious activity within the network. While other forensic techniques may complement the investigation, NetFlow analysis is the most relevant choice in this context.
- A. Correct.
Performing a NetFlow analysis is the most appropriate forensic technique in this scenario because Cisco Secure Network Analytics specializes in monitoring and analyzing network traffic to detect anomalies and malicious behavior.
- B. Incorrect.
Conducting a memory dump is useful in endpoint forensics but is not applicable to network traffic analysis, which is the focus of this task.
- C. Incorrect.
Analyzing file changes using EDR tools is an endpoint-specific forensic technique, not related to investigating network traffic with Cisco Secure Network Analytics.
- D. Incorrect.
Reviewing DNS logs is a valid forensic technique but is not the primary focus when using Cisco Secure Network Analytics to investigate traffic anomalies.