At a bank, leadership wants to know which conversations moved the most data last month, and no packets from that month were retained. Which source can still answer the volume question?
Select an answer to reveal the explanation.
Short Explanation
You can still compare which conversations moved the most data using retained NetFlow byte counts, even though no packets from last month remain. A tap whose copies were never saved, a file hash without conversation details, and a proxy log for traffic that bypassed the proxy cannot answer that volume question.
Full Explanation
NetFlow session records summarize each conversation, including how many bytes moved, without storing the payload. Because leadership wants to identify the conversations that moved the most data and no packets from last month were retained, the NetFlow records that still list byte counts can answer the question: you can compare the recorded volumes. They cannot recover a file, but file recovery is not what is being asked. A network tap whose copies were never saved, so no packets remain from that month, cannot provide a retrospective answer; a tap is useful for reviewing packet contents only when its copies were retained. An antivirus file hash, with no record of conversation sizes or partner addresses, identifies a file on a host but does not show which conversations moved the most data. A web proxy log for traffic that never passed through the proxy at all cannot describe those conversations, because that traffic is absent from the log. Exam caveat: session records can rank conversations by byte count, but they do not contain the payload a retained tap would show. Practical check: retrieve the retained flow records for the month, sort by bytes, and confirm the export covers the network segments leadership asked about.