A government agency needs to monitor its network for unusual data exfiltration attempts. Traditional log data is insufficient to identify traffic anomalies, so the SIEM team integrates traffic flow…

Question

Options

• ASNMP (Simple Network Management Protocol)
• BNetFlow (RFC 3954)
• CSyslog
• DIPFIX (IP Flow Information Export)

• A
  2% (1)
• B
  2% (1)
• C
  4% (2)
• D
  93% (50)

Explanation

IPFIX is the modern standard for exporting IP flow information from network devices and is specifically designed for collecting flow telemetry (who talked to whom, when, for how long, how much data, and over what ports/protocols). In SOC monitoring, flow data is crucial for detecting exfiltration patterns, beaconing, and anomalous traffic volumes-especially when payload inspection is limited due to encryption. NetFlow is a widely used flow protocol and is the predecessor lineage to IPFIX, but IPFIX is the standards-based evolution that supports broader extensibility and vendor- neutral interoperability. Syslog is primarily for event/log messages, not flow summaries. SNMP is commonly used for device management and interface counters, but it is not the primary protocol for exporting detailed per-flow records needed for behavioral network analytics and exfil detection. Because the question asks for a protocol to collect IP traffic flow information in a standardized way for SIEM integration, IPFIX is the best choice. SOC teams then correlate IPFIX with DNS, proxy, and endpoint telemetry to validate whether large flows represent legitimate business transfers or suspicious exfiltration.

No community discussion yet for this question.