Examkin

Soru

Zorluk: KolayNetwork Security Monitoring and Alerting

A network administrator needs to monitor enterprise traffic volumes, protocol distributions, and IP communication pairs across internal routers without inspecting or storing packet payloads. Which of the following monitoring mechanisms should the administrator implement?

  1. NetFlow flow telemetry collectionCevap
  2. B
    Inline honeypot deployment
  3. C
    Web application firewall inspecting SQL payloads
  4. D
    Host-based antivirus signature scanner

Cevap

NetFlow flow telemetry collection is the correct mechanism because it captures network session metadata (source/destination IPs, ports, and transfer sizes) across network devices without storing full packet payloads.
NetFlow flow telemetry collection gathers lightweight session metadata—including source and destination IP addresses, ports, protocol types, and byte counts—from network devices. It allows security analysts to observe network traffic statistics across the enterprise without the overhead of full packet payload capture.

Adım Adım Çözüm

1
Identify the core requirement from the scenario.
The requirement is to track network traffic volume, protocols, and IP communication pairs across routers without storing packet payloads.
Understanding the monitoring requirements narrows down full packet capture versus flow-based telemetry mechanisms.
2
Evaluate the capabilities of network flow technologies.
NetFlow/IPFIX aggregates traffic metadata (headers, byte counts, session durations) at router interfaces without payload recording.
Flow data provides high-level visibility across broad network infrastructure with minimal storage overhead.

Anahtar Kavram

Network Flow Monitoring (NetFlow/IPFIX)
Tahmini Süre:45s
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru