SY0-701 Question 399
Single answerData sources: Vulnerability scans , Automated reports , Dashboards , Packet capturesA security analyst is investigating reports that several internal web servers are intermittently failing health checks after a recent patch cycle. Management wants the analyst to quickly determine whether the issue is most likely caused by missing patches, an ongoing network-based attack, or a broader trend affecting multiple systems. Which data source would provide the BEST immediate evidence of actual network traffic behavior to help distinguish between these possibilities?
- A
Vulnerability scan results from the previous week
- B
An executive security dashboard showing monthly risk scores
- C
A packet capture taken during the health-check failures
- D
An automated compliance report generated at the end of the quarter
Show answer and explanation
Correct answer: C
Explanation
Packet captures are the best choice when an analyst needs to observe what is actually happening on the wire during an event. They can help differentiate between several possibilities in this scenario: whether health checks are failing because the servers are not responding correctly, because an attacker is generating disruptive traffic, or because there are transport-level issues such as retransmissions or resets. By contrast, vulnerability scans identify known weaknesses and missing patches, dashboards summarize posture and trends, and automated reports provide scheduled summaries for management or compliance purposes. Security operations best practice is to use the data source that most directly answers the investigative question: for live traffic behavior, that is packet capture data. This aligns with common incident response and network troubleshooting guidance from sources such as NIST SP 800-61 for incident handling and standard packet analysis practices used in enterprise security operations.
- A. Incorrect.
Incorrect. Vulnerability scan results can identify missing patches, exposed services, and known weaknesses, but they do not show real-time or near-real-time traffic behavior during the outage. A previous week's scan may help determine whether unpatched systems exist, but it is not the best immediate source for confirming whether the failures are due to active malicious traffic, protocol errors, or connection resets occurring during the incident.
- B. Incorrect.
Incorrect. An executive dashboard is useful for summarizing trends, KPIs, and overall security posture across systems, but it is too high level for incident troubleshooting. Monthly risk scores may indicate that risk has increased, yet they will not reveal whether health checks are failing because of SYN floods, dropped packets, malformed responses, or other network conditions affecting the servers right now.
- C. Correct.
Correct. A packet capture provides direct visibility into network traffic at the time of the problem, including connection attempts, resets, retransmissions, malformed packets, unexpected source addresses, and signs of denial-of-service or other network-based attacks. In this scenario, the analyst needs immediate evidence of actual traffic behavior during the failures, and packet captures are the most appropriate data source for that purpose.
- D. Incorrect.
Incorrect. Automated compliance reports are designed to summarize control status, policy alignment, or audit findings over a reporting period. They can be useful for governance and identifying systemic issues, but they are not intended to capture live packet-level evidence or explain why intermittent health checks are failing during an active investigation.