What is a difference between a flow and an event?

Question

Options

• AA flow is a record from a log source, such as a firewall or router device, that describes an action on
• BA flow occurs at a moment in time while events have a duration from a log source.
• CAn event is a record from a log source, such as a firewall or router device, that describes an action
• DAn event occur at a moment in time while flows have a duration from the flow source.

• A
  6% (3)
• B
  2% (1)
• C
  82% (40)
• D
  10% (5)

Explanation

Option C is correct because an event is indeed a record from a log source (firewall, router, IDS, etc.) that captures a specific action or occurrence at a point in time - this is the standard definition used in SIEM platforms like IBM QRadar.

Why the distractors fail:

• A swaps the definitions - it describes an event using the word "flow," making it factually backwards.
• B reverses the temporal nature: events occur at a moment in time, not flows; flows are the ones with duration (they represent network communication over a time span).
• D gets the duration relationship right (flows have duration) but misidentifies what "occurs at a moment in time" - that's an event, not what D claims.

Memory tip: Think Event = Ephemeral snap (a single logged action, like a firewall deny at 10:03:42). Think Flow = Flowing water - it moves between two points over time, representing a session or conversation between hosts. Events are instants; flows are intervals.

No community discussion yet for this question.