N10-005 · Question #342
A network technician has been asked to look into a report from the IDS to determine why traffic is being sent from an internal FTP server to an external website. Which of the following tools can be…
The correct answer is D. Protocol analyzer. A protocol analyzer captures and decodes network packets at the frame level, allowing a technician to inspect the actual content and destination of suspicious traffic.
Question
A network technician has been asked to look into a report from the IDS to determine why traffic is being sent from an internal FTP server to an external website. Which of the following tools can be used to inspect this traffic?
Options
- ARouter firewall
- BPing and traceroute
- CThroughput tester
- DProtocol analyzer
How the community answered
(20 responses)- A5% (1)
- C5% (1)
- D90% (18)
Why each option
A protocol analyzer captures and decodes network packets at the frame level, allowing a technician to inspect the actual content and destination of suspicious traffic.
A router firewall can block or permit traffic based on rules but does not provide the detailed packet-level inspection needed to investigate the content or reason for the traffic.
Ping and traceroute test connectivity and path reachability but cannot capture or inspect the content of traffic flows.
A throughput tester measures bandwidth and data transfer rates but does not decode or analyze packet contents.
A protocol analyzer (such as Wireshark) captures raw network frames and decodes them layer by layer, allowing a technician to examine source/destination IPs, ports, and payload data to determine why an FTP server is communicating with an external website. This deep packet inspection is the only tool among the options that can reveal the specifics of the suspicious traffic.
Concept tested: Protocol analyzer for network traffic inspection
Source: https://www.wireshark.org/docs/wsug_html_chunked/ChapterIntroduction.html
Topics
Community Discussion
No community discussion yet for this question.