Which StealthWatch device monitors, analyzes, separates, categorizes, and stores information from each flow, allowing it to create a baseline of typical expected network activity?

Question

Options

• AFlow collector
• BAdvanced malware protection
• CForensic investigation
• DMalware clustering

• A
  91% (31)
• C
  6% (2)
• D
  3% (1)

Explanation

Flow Collector is the StealthWatch component specifically designed to monitor, analyze, separate, categorize, and store flow data - it acts as the network's memory, building behavioral baselines that define what "normal" traffic looks like so anomalies can be detected.

Why the distractors are wrong:

• B. Advanced Malware Protection (AMP) is a separate Cisco product focused on detecting and blocking malware at endpoints and across the network - not a StealthWatch component responsible for flow baseline creation.
• C. Forensic Investigation describes a capability or activity, not a StealthWatch device; it's something you perform using collected data, not something that collects and categorizes flows.
• D. Malware Clustering is a StealthWatch analytical feature that groups similar suspicious behaviors together - it depends on already-collected flow data rather than being the component that collects and stores it.

Memory tip: Think "Flow Collector collects flows" - its name literally describes its job. Just as a data collector gathers and organizes information, the Flow Collector gathers, categorizes, and stores network flow records to establish the baseline everything else is measured against.

No community discussion yet for this question.