Examkin

Question

Difficulty: EasyNetwork Security Monitoring and Alerting

A network administrator needs to monitor enterprise traffic volumes, protocol distributions, and IP communication pairs across internal routers without inspecting or storing packet payloads. Which of the following monitoring mechanisms should the administrator implement?

  1. NetFlow flow telemetry collectionAnswer
  2. B
    Inline honeypot deployment
  3. C
    Web application firewall inspecting SQL payloads
  4. D
    Host-based antivirus signature scanner

Answer

NetFlow flow telemetry collection is the correct mechanism because it captures network session metadata (source/destination IPs, ports, and transfer sizes) across network devices without storing full packet payloads.
NetFlow flow telemetry collection gathers lightweight session metadata—including source and destination IP addresses, ports, protocol types, and byte counts—from network devices. It allows security analysts to observe network traffic statistics across the enterprise without the overhead of full packet payload capture.

Step-by-Step Solution

1
Identify the core requirement from the scenario.
The requirement is to track network traffic volume, protocols, and IP communication pairs across routers without storing packet payloads.
Understanding the monitoring requirements narrows down full packet capture versus flow-based telemetry mechanisms.
2
Evaluate the capabilities of network flow technologies.
NetFlow/IPFIX aggregates traffic metadata (headers, byte counts, session durations) at router interfaces without payload recording.
Flow data provides high-level visibility across broad network infrastructure with minimal storage overhead.

Key Concept

Network Flow Monitoring (NetFlow/IPFIX)
Estimated Time:45s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic