200-201 · Question #117
Which IETF standard technology is useful to detect and analyze a potential security incident by recording session flows that occurs between hosts?
The correct answer is D. IPFIX. IPFIX (IP Flow Information Export) is an IETF standard that specifies the format for exporting network flow information, which is crucial for monitoring network traffic, detecting anomalies, and analyzing potential security incidents.
Question
Which IETF standard technology is useful to detect and analyze a potential security incident by recording session flows that occurs between hosts?
Options
- ASFlow
- BNetFlow
- CNFlow
- DIPFIX
How the community answered
(39 responses)- A3% (1)
- B3% (1)
- C5% (2)
- D90% (35)
Why each option
IPFIX (IP Flow Information Export) is an IETF standard that specifies the format for exporting network flow information, which is crucial for monitoring network traffic, detecting anomalies, and analyzing potential security incidents.
sFlow is a sampling technology for network monitoring, but it is a multi-vendor standard initially developed by InMon, not an IETF standard like IPFIX, and relies on sampled data rather than comprehensive flow records.
NetFlow is a Cisco-proprietary technology for collecting IP traffic information, while widely adopted, it is not an IETF standard itself; IPFIX is the IETF standard based on NetFlow concepts.
NFlow is not a recognized or standard network flow technology; it appears to be a fictitious option.
IPFIX (IP Flow Information Export) is a standardized Internet Engineering Task Force (IETF) protocol (RFC 5101) for exporting network flow information, essentially a universal version of NetFlow. It allows network devices to collect and export data about IP traffic flows, which is then used by collectors for comprehensive network monitoring, security analysis, and incident detection by providing visibility into session flows between hosts.
Concept tested: Network flow monitoring standards (IPFIX)
Source: https://datatracker.ietf.org/doc/html/rfc5101
Topics
Community Discussion
No community discussion yet for this question.