Objective 4.9: Given a scenario, use data sources to support an investigation
Security+ SY0-701 practice question
An analyst is investigating a report that a workstation sent a confidential design file to an external server last Tuesday over plain FTP. Firewall logs confirm an FTP session from the workstation to the server, with the control connection on TCP port 21 and about 40 MB of data transferred during the session. The analyst must now determine exactly which file was sent. Which data source would BEST provide this information?
- Packet capture from the network sensor for that period(Correct)
Correct. FTP sends commands and data in cleartext, so the capture contains the file name in the transfer command and the file contents in the data connection. It can prove exactly which file left the network.
- NetFlow records for the workstation's subnet
NetFlow records addresses, ports, timestamps, and byte counts. It would confirm the 40 MB transfer the firewall logs already show, but it never includes file names or contents.
- DNS query logs from the internal resolvers for that day
DNS query logs show which host names the workstation resolved and when. They could show how the workstation found the FTP server, but DNS traffic never carries the files or FTP commands, so they cannot show which file was sent.
- IPS alerts from the network sensor for that day
IPS alerts are raised only when traffic matches a signature or policy, and an alert usually records just the triggering packet and rule. An ordinary file upload over FTP may raise no alert at all, and even an alert would not reliably identify the transferred file.
Explanation
Choose the data source that holds the specific detail you need. Firewall logs and flow records show that a connection happened and how much data moved, but not what was inside it. A packet capture holds the actual traffic, and because plain FTP is unencrypted, the capture shows the commands (including the file names) and can even be used to reconstruct the file that was transferred.