350-201 Question 152
Select 4A network administrator is troubleshooting an ongoing issue with intermittent connectivity on a critical server. They decide to use multiple tools, including a packet capture tool, a traffic analysis tool, and a network log analysis tool. Which of the following limitations should they consider when using these tools to diagnose the problem?
- A
Packet capture tools can generate very large data files, making analysis time-consuming without automated filtering.
- B
Traffic analysis tools cannot analyze historical data as they focus only on real-time traffic patterns.
- C
Network log analysis tools may miss events if logging levels are not correctly configured or logs are overwritten.
- D
Packet capture tools are unable to monitor encrypted traffic effectively without decryption mechanisms.
- E
Traffic analysis tools are not capable of identifying packet payload details, such as file content inside the traffic.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
When diagnosing network issues, it is important to understand the limitations of the tools being used. Packet capture tools may generate large volumes of data and struggle with encrypted traffic, while traffic analysis tools cannot inspect packet payloads. Network log analysis tools require proper configuration and sufficient storage to avoid missing critical events. Recognizing these limitations helps ensure accurate and efficient troubleshooting.
- A. Correct.
Packet capture tools can indeed create large files due to the sheer volume of data they collect, meaning administrators need to filter or automate analysis to avoid spending excessive time on manual review. This is a valid limitation.
- B. Incorrect.
While traffic analysis tools primarily focus on real-time traffic patterns, many modern tools also support historical analysis by integrating with storage solutions. Hence, this is not always a limitation.
- C. Correct.
Network log analysis tools rely on properly configured logging levels to capture all necessary events. Additionally, logs can be overwritten if storage limits are reached, leading to potential data loss. This is a valid limitation.
- D. Correct.
Packet capture tools cannot directly analyze encrypted traffic unless encryption keys or decryption mechanisms are available, making them less effective in environments with heavy encryption. This is a valid limitation.
- E. Correct.
Traffic analysis tools focus on metadata and flow patterns rather than packet payload or content inspection. They cannot provide insight into the actual data being transmitted, like file contents. This is a valid limitation.