SY0-701 Question 314
Single answerA security administrator must improve visibility into suspicious outbound traffic from several remote office routers and quickly identify which internal hosts are communicating with an unfamiliar external IP address. The company does not want to install software on the routers, but it does want to centralize analysis and correlate traffic data with firewall and endpoint alerts. Which solution would BEST meet this requirement?
- A
Configure the routers to export NetFlow records to a SIEM
- B
Install antivirus agents on the routers and forward detections to a SIEM
- C
Deploy SCAP benchmarks to the routers to baseline outbound traffic patterns
- D
Enable DLP on the routers to capture all suspicious network sessions
Show answer and explanation
Correct answer: A
Explanation
The best answer is to configure the routers to export NetFlow records to a SIEM. NetFlow is specifically designed to summarize network traffic flows and is commonly supported on routers and other network devices without requiring software agents. A SIEM can ingest NetFlow alongside firewall logs, IDS/IPS events, and endpoint alerts to correlate suspicious activity and accelerate investigations. This approach aligns with common security operations practices for network visibility and incident response. By contrast, SCAP benchmarks are for configuration and compliance assessment, antivirus is an endpoint malware control rather than a router traffic analysis tool, and DLP focuses on preventing sensitive data exfiltration rather than providing broad network flow visibility. This is consistent with vendor and industry guidance on flow analysis and centralized event correlation, including NIST discussions of security continuous monitoring and standardized configuration assessment through SCAP.
- A. Correct.
Correct. NetFlow provides metadata about network conversations, such as source and destination IPs, ports, protocols, interfaces, and traffic volume. Exporting NetFlow from routers to a SIEM allows centralized analysis and correlation with other log sources like firewalls and endpoint tools. This directly addresses the need to identify internal hosts communicating with an unfamiliar external IP without installing software on the routers.
- B. Incorrect.
Incorrect. Antivirus agents are designed to detect malicious software on hosts, not to provide router-level flow visibility. In addition, routers typically do not support traditional antivirus agents in the way endpoints do. A candidate might choose this option because SIEM correlation is mentioned, but the underlying data source does not fit the device type or the stated requirement.
- C. Incorrect.
Incorrect. SCAP benchmarks are used to assess configuration compliance and security posture against standardized baselines, such as secure configuration settings. They are not used to monitor live outbound traffic patterns or identify which hosts are communicating with a destination in real time. This distractor targets the misconception that any security standard or benchmarking tool can provide operational network telemetry.
- D. Incorrect.
Incorrect. DLP is intended to detect and prevent unauthorized transmission of sensitive data, often through email, web uploads, endpoint actions, or network inspection points. While DLP may inspect content for policy violations, it is not the best tool for identifying general traffic flows between internal hosts and an unfamiliar external IP, especially when the requirement is router-based visibility without adding software.