200-201 · Question #242
When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?
The correct answer is A. full packet capture. Full packet capture provides the most detailed information, including actual data payloads, which is essential for confirming if specific sensitive data has been exfiltrated from a network.
Question
When an event is investigated, which type of data provides the investigate capability to determine if data exfiltration has occurred?
Options
- Afull packet capture
- BNetFlow data
- Csession data
- Dfirewall logs
How the community answered
(54 responses)- A91% (49)
- B2% (1)
- C6% (3)
- D2% (1)
Why each option
Full packet capture provides the most detailed information, including actual data payloads, which is essential for confirming if specific sensitive data has been exfiltrated from a network.
Full packet capture records every byte of data transmitted over the network, including the entire payload of packets. This comprehensive detail allows investigators to examine the exact content of communications, definitively determining if sensitive information has been improperly sent outside the network.
NetFlow data provides metadata about network traffic (source/destination IPs, ports, protocols, data volumes) but does not include the actual content of the packets, making it insufficient to confirm data exfiltration.
Session data typically summarizes connection information and does not contain the packet payloads necessary to confirm the specific data exfiltrated.
Firewall logs record connection attempts and policy actions but do not contain the payload of the packets, meaning they cannot reveal *what* data might have been exfiltrated.
Concept tested: Data types for exfiltration investigation
Source: https://www.cisco.com/c/en/us/products/security/network-visibility-security/what-is-full-packet-capture.html
Topics
Community Discussion
No community discussion yet for this question.