350-201 Question 184
Select 2A security analyst is investigating unusual traffic patterns and needs to extract packets for further analysis. Which tools or methods should the analyst use to capture and identify packet data for detailed inspection?
- A
Wireshark
- B
tcpdump
- C
NetFlow
- D
Cisco Talos Threat Intelligence
- E
Packet Tracer
Show answer and explanation
Correct answers: A, B
Explanation
When analyzing unusual traffic patterns, tools like Wireshark and tcpdump are essential for capturing and inspecting raw packet data. These tools enable security analysts to extract specific packet samples for in-depth analysis, which is critical for identifying potential threats. NetFlow, Cisco Talos Threat Intelligence, and Packet Tracer do not serve this purpose, as they either provide aggregate data or are not designed for live packet capture and analysis.
- A. Correct.
Wireshark is a widely used packet capture and analysis tool that allows the analyst to extract and inspect packet data in detail. It is ideal for identifying malicious traffic.
- B. Correct.
tcpdump is a command-line packet analysis tool that can capture and display packets for inspection, making it suitable for extracting samples for analysis.
- C. Incorrect.
NetFlow provides aggregated flow data for network traffic but does not capture individual packets for detailed inspection.
- D. Incorrect.
Cisco Talos Threat Intelligence is a threat intelligence platform that provides information about known threats but does not perform packet capture or analysis.
- E. Incorrect.
Packet Tracer is a network simulation tool typically used for training purposes and does not support real-world packet capture or analysis.