350-201 Question 183
Select 3During a security investigation, you suspect that an internal workstation is communicating with a malicious external server. You are tasked with extracting and analyzing network traffic to confirm the suspicion. Which of the following actions should you take to extract and identify samples for analysis using packet capture or packet analysis tools?
- A
Use a network packet capture tool like Wireshark to record traffic from the suspected workstation.
- B
Analyze packet headers and payloads for anomalies or known malicious patterns.
- C
Use NetFlow data exclusively to identify and confirm malicious traffic.
- D
Export the captured packets into a PCAP file for further offline analysis.
- E
Rely only on the output of the firewall logs to identify malicious communication.
Show answer and explanation
Correct answers: A, B, D
Explanation
To extract and identify samples for analysis, packet capture tools like Wireshark should be used to gather network traffic. Analyzing packet headers and payloads can reveal anomalies or malicious patterns, and exporting the traffic as a PCAP file allows for detailed offline analysis. While NetFlow and firewall logs provide useful supplementary information, they lack the level of detail required for comprehensive packet analysis.
- A. Correct.
Correct: Using a packet capture tool like Wireshark is a standard way to record and inspect network traffic in real-time, making it essential for extracting samples.
- B. Correct.
Correct: Analyzing packet headers and payloads helps in identifying anomalies or malicious indicators, providing critical insights during investigations.
- C. Incorrect.
Incorrect: NetFlow data provides high-level flow information but does not include detailed packet content, making it insufficient for deep analysis in this case.
- D. Correct.
Correct: Exporting packets into a PCAP file allows for detailed offline analysis and sharing with other tools or analysts, which is a best practice in investigations.
- E. Incorrect.
Incorrect: Firewall logs can provide useful information but are not sufficient for extracting and analyzing detailed packet-level data.