200-201 Security Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  NetFlow/IPFIX analysis comparing current traffic to baseline

  Why this is correct

  NetFlow/IPFIX records flow metadata — source, destination, byte counts and timestamps — letting the analyst compare the 50 MB foreign transfer against the 1-2 MB hourly baseline. Encryption hides payload contents, but flow volume and destination still confirm exfiltration.

• ✗

  Snort IDS with a rule to detect large file transfers

  Why it's wrong here

  Snort signatures match packet contents or headers; encrypted payloads defeat content rules, and volume thresholds are not reliably expressible as signatures. It is tempting because IDS rules can flag large transfers, but Snort is the correct choice when detecting known plaintext attack patterns rather than confirming encrypted exfiltration.

• ✗

  Wireshark packet capture with a display filter for the destination IP

  Why it's wrong here

  The traffic is encrypted, so a Wireshark capture filtered on the destination IP reveals only ciphertext and flow volume, not the exfiltrated content. It is tempting because packet capture confirms the transfer occurred, but it is the correct choice when payloads are unencrypted and protocol-level detail is needed.

• ✗

  Windows Event Logs for file access

  Why it's wrong here

  Windows Event Logs record local file access, not outbound network volume or destination geography, so they cannot confirm exfiltration to a foreign IP. They are tempting because file-access auditing can reveal which files were read, but that is the correct choice only when investigating insider copying on the host itself.

Go deeper

Related to this question