350-201 Question 149
Select 3During a network security investigation, an analyst uses packet capture tools, traffic analysis tools, and network log analysis tools to identify a potential data exfiltration attempt. However, the analyst notices that the tools are providing incomplete or conflicting information. What could be potential limitations of these tools in this scenario?
- A
Packet capture tools can be overwhelmed by high traffic volumes, causing packet loss.
- B
Traffic analysis tools cannot decrypt encrypted traffic, limiting their visibility.
- C
Network log analysis tools provide real-time insights but may lack historical data.
- D
Packet capture tools cannot distinguish between malicious and legitimate traffic without context.
- E
Traffic analysis tools are designed to replace network log analysis tools entirely.
Show answer and explanation
Correct answers: A, B, D
Explanation
The limitations of network analysis tools depend on their specific capabilities and design. Packet capture tools are useful for capturing raw traffic data but may struggle with high traffic volumes and require contextual analysis to interpret the data. Traffic analysis tools are effective for understanding network behavior but cannot inspect encrypted traffic without decryption. Network log analysis tools focus on analyzing logs and may lack real-time capabilities if not configured properly. Understanding these limitations helps cybersecurity professionals choose the right tool or combination of tools for a given scenario.
- A. Correct.
Packet capture tools can experience performance issues when dealing with high traffic volumes, leading to potential packet loss and incomplete data.
- B. Correct.
Traffic analysis tools cannot decrypt encrypted traffic (e.g., HTTPS), which limits their ability to fully analyze encrypted communications.
- C. Incorrect.
Network log analysis tools are designed to provide both historical and real-time insights, depending on how logs are stored and analyzed. This statement is inaccurate.
- D. Correct.
Packet capture tools only capture raw traffic data and require additional context and analysis to determine whether the traffic is malicious or legitimate.
- E. Incorrect.
Traffic analysis tools complement, rather than replace, network log analysis tools. They serve different purposes in network monitoring and analysis.