A security analyst who is concerned about sensitive data exfiltration reviews the following: Which of the following tools would allow the analyst to confirm if data exfiltration is occuring?

The correct answer is D. Protocol analyzer. A protocol analyzer (also called a packet analyzer or network sniffer, e.g., Wireshark) captures and inspects actual network traffic at the packet level. It allows the analyst to see what data is being transmitted, to which destinations, over which protocols, and at what volume…

Enterprise Security Operations

Question

A security analyst who is concerned about sensitive data exfiltration reviews the following:

Which of the following tools would allow the analyst to confirm if data exfiltration is occuring?

Options

APort scanner
BSCAP tool
CFile integrity monitor
DProtocol analyzer

How the community answered

(60 responses)

A
5% (3)
B
7% (4)
C
2% (1)
D
87% (52)

Explanation

A protocol analyzer (also called a packet analyzer or network sniffer, e.g., Wireshark) captures and inspects actual network traffic at the packet level. It allows the analyst to see what data is being transmitted, to which destinations, over which protocols, and at what volume - directly confirming whether sensitive data (PII, credentials, documents) is leaving the network. This is the only tool that provides real-time visibility into the content and destination of outbound traffic. Option A (port scanner) identifies open ports but does not capture or inspect traffic content. Option B (SCAP tool) is used for compliance and configuration auditing, not traffic analysis. Option C (file integrity monitor) detects changes to files on disk but cannot observe what is transmitted over the network - data could be exfiltrated without modifying the original file.

Topics

#data exfiltration#protocol analyzer#network monitoring#DLP

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice