350-201 Question 182
Select 3During a cybersecurity investigation, you are tasked with analyzing suspicious network traffic. You need to extract and identify relevant samples for analysis using packet capture or packet analysis tools. Which of the following steps should you perform to ensure accurate and actionable data collection?
- A
Use a packet capture tool like Wireshark to capture traffic during the suspected incident timeframe.
- B
Filter the capture to only include traffic relevant to the suspected source or destination IP address.
- C
Randomly select a subset of packets from the network without any filtering to save time.
- D
Analyze extracted packet data for unusual protocols, payloads, or anomalies.
- E
Avoid capturing encrypted traffic as it cannot be analyzed effectively.
Show answer and explanation
Correct answers: A, B, D
Explanation
To effectively extract and identify samples for analysis, it is essential to use tools like Wireshark to capture relevant network traffic during the incident timeframe. Filtering the capture to focus on specific IPs, ports, or protocols ensures that the data collected is actionable. Once the data is captured, detailed packet analysis should be performed to identify anomalies or malicious activity. Avoiding random selection of packets and dismissing encrypted traffic ensures a comprehensive and targeted investigation.
- A. Correct.
Using a packet capture tool like Wireshark during the timeframe of the incident is critical to obtaining the relevant network traffic for analysis.
- B. Correct.
Filtering the capture to focus on relevant IP addresses or ports helps narrow down the scope of data and ensures the samples are pertinent to the investigation.
- C. Incorrect.
Randomly selecting packets without filtering is not an effective strategy, as it may lead to missing critical data related to the incident.
- D. Correct.
Analyzing the packet data for unusual protocols, payloads, or patterns is necessary to identify potential malicious activity or anomalies.
- E. Incorrect.
Encrypted traffic can still be captured and analyzed for metadata, such as headers or SSL/TLS handshake patterns, even if the payload cannot be decrypted.