At a university, an investigation only needs to know who talked to a rare address and how many bytes moved. Compared with a full packet capture, which lighter source answers that question?
Select an answer to reveal the explanation.
Short Explanation
The luggage tag already shows the destination and the weight, so the suitcase can stay shut. You can answer who talked to a rare address, and how many bytes moved, from NetFlow. The trap is demanding a full capture, a sandbox run, or a registry key for a conversation summary.
Full Explanation
NetFlow stores a conversation summary: addresses, ports, protocol, and byte counts. The investigation asks only who talked to a rare address and how many bytes moved, and that is what session records hold. The lighter source is NetFlow session records that already list the rare address and the byte counts. A full capture would also show the parties and the volume, and it is heavier than this question requires. A full packet capture, treated as required before any byte count can be trusted overstates the need, because flow records already carry byte counts without the payload. A malware sandbox detonation, treated as the record of who talked to whom runs a file in a controlled environment and is not a record of this campus conversation. A registry run key, treated as the record of the remote conversation size is a host persistence artifact and does not count bytes on the wire. Exam caveat: use session records when the question is parties and volume, and move to packets when the question turns to payload or a transferred object. Operational check: query the flow records for the rare address and sort by bytes, and pull a capture only if a later question asks for content.