200-201 · Question #314
Refer to exhibit. An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?
The correct answer is C. data encryption. The analyst faced challenges with data visibility due to data encryption, as encrypted traffic prevents direct inspection of payload content within the PCAP file.
Question
Refer to exhibit. An analyst performs the analysis of the pcap file to detect the suspicious activity. What challenges did the analyst face in terms of data visibility?
Exhibit
Options
- Adata encapsulation
- Bcode obfuscation
- Cdata encryption
- DIP fragmentation
How the community answered
(26 responses)- A4% (1)
- B4% (1)
- C92% (24)
Why each option
The analyst faced challenges with data visibility due to data encryption, as encrypted traffic prevents direct inspection of payload content within the PCAP file.
Data encapsulation is a normal networking process visible in a PCAP and does not inherently hide the data content.
Code obfuscation applies to code within an application or malware, not directly to the visibility of network data in a PCAP file.
Data encryption, such as TLS/SSL, encrypts the payload of network packets, rendering the actual application data unreadable in a PCAP file without the corresponding private key for decryption. This significantly reduces data visibility for an analyst attempting to understand the content of the traffic.
IP fragmentation breaks IP packets into smaller pieces, which are reassembled by analysis tools, so it does not hide the data content.
Concept tested: Network traffic analysis challenges (encryption)
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/tls-and-ssl
Topics
Community Discussion
No community discussion yet for this question.
