SY0-501 · Question #171
A penetration testing is preparing for a client engagement in which the tester must provide data that proves and validates the scanning tools' results. Which of the following is the best method for…
The correct answer is B. Use a protocol analyzer to log all pertinent network traffic. To validate penetration testing scan results, the best method for collecting proof data is to use a protocol analyzer to capture and log all relevant network traffic.
Question
A penetration testing is preparing for a client engagement in which the tester must provide data that proves and validates the scanning tools' results. Which of the following is the best method for collecting this information?
Options
- ASet up the scanning system's firewall to permit and log all outbound connections
- BUse a protocol analyzer to log all pertinent network traffic
- CConfigure network flow data logging on all scanning system
- DEnable debug level logging on the scanning system and all scanning tools used.
How the community answered
(44 responses)- A7% (3)
- B80% (35)
- C2% (1)
- D11% (5)
Why each option
To validate penetration testing scan results, the best method for collecting proof data is to use a protocol analyzer to capture and log all relevant network traffic.
Firewall logs record connection attempts and allow/deny decisions but do not capture the actual data payloads or detailed protocol interactions exchanged during the scan, which are necessary for validation.
A protocol analyzer captures raw network packets, providing granular detail of every request sent by the scanning tool and every response received from the target, which serves as irrefutable evidence to validate scan results and tool behavior.
Network flow data logging (e.g., NetFlow, IPFIX) provides summarized metadata about network conversations like source, destination, ports, and byte counts, but lacks the deep packet content needed to prove scan results.
Debug level logging on the scanning system and tools provides internal operational details and the tool's interpretation of events, but it does not offer the objective, raw network traffic data required for external validation and proof of the scan's network interaction.
Concept tested: Network traffic analysis for penetration testing validation
Source: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-overview-packet-capture
Topics
Community Discussion
No community discussion yet for this question.