350-201 Question 181
Select 3While investigating a potential data breach, your cybersecurity team suspects malicious activity within network traffic. As a Cisco Security Analyst, you have been tasked with extracting and analyzing network traffic to identify anomalies. Which of the following tools or methods are most appropriate for capturing and analyzing packet data to assist in this investigation?
- A
Wireshark for packet capture and deep packet analysis
- B
tcpdump for capturing raw packet data
- C
Cisco Umbrella for DNS-layer security analysis
- D
NetFlow for flow-based traffic analysis
- E
Cisco Secure Endpoint for endpoint behavior analysis
Show answer and explanation
Correct answers: A, B, D
Explanation
To extract and identify samples for analysis, tools like Wireshark and tcpdump are used for capturing and inspecting packet-level data. NetFlow is also useful for identifying traffic patterns and anomalies at a flow level. These tools collectively assist in identifying malicious activity within network traffic. However, solutions like Cisco Umbrella and Cisco Secure Endpoint are not directly used for packet capturing or analysis; they serve other cybersecurity purposes.
- A. Correct.
Wireshark is a highly effective tool for capturing and analyzing packets, providing detailed insights into network traffic and potential anomalies.
- B. Correct.
tcpdump is a command-line tool that allows raw packet capture, which can then be analyzed manually or through other tools.
- C. Incorrect.
Cisco Umbrella is a cloud-based security solution focused on DNS-layer protection, not typically used for packet capture or detailed packet analysis.
- D. Correct.
NetFlow provides flow-level traffic information, which can complement packet analysis by identifying traffic patterns, though it does not provide full packet details.
- E. Incorrect.
Cisco Secure Endpoint is primarily used for endpoint threat detection and response, rather than packet capture or network traffic analysis.