Objective 4.4: Explain security alerting and monitoring concepts and tools
Security+ SY0-701 practice question
A network security team wants to see which internal hosts communicate with which external IP addresses, on which ports, and how much data each conversation transfers. The records must be kept for 90 days, storage is limited, and the contents of the traffic must not be stored. Which tool BEST meets these needs?
- Full packet capture on the internet uplink
Full packet capture records the payloads, which the requirement forbids, and keeping 90 days of full captures for an internet uplink would need far more storage than the team has.
- SNMP traps sent from the core switches
SNMP traps are event notifications from devices, such as an interface going down or a threshold being crossed. They do not describe individual host-to-host conversations.
- A SCAP-based compliance scanner
A SCAP-based scanner checks systems against configuration benchmarks and known vulnerabilities. It does not monitor network traffic.
- NetFlow collection from the edge routers(Correct)
Correct. NetFlow records who communicated with whom, on which ports, and how much data was transferred, without storing content, so 90 days of retention fits limited storage.
Explanation
NetFlow (and the similar IPFIX standard) records metadata about each conversation: source and destination addresses, ports, protocol, timestamps, and byte and packet counts. It does not store payloads, so it is compact enough to keep for long periods and still answers "who talked to whom, on what port, and how much". Packet capture answers "what exactly was said", at a much higher storage cost.