At a retailer, an analyst needs only who talked to whom, when they talked, and how many bytes moved, for one flow from last week. Which data type answers that request?
Select an answer to reveal the explanation.
Short Explanation
A phone bill shows who called, when, and for how long, not the words that were spoken. You want session data for the parties, the time, and the byte counts. The trap is the payload, an email body, or a malware hash.
Full Explanation
Session data summarizes a conversation: who communicated, when, and how much moved, often with ports and protocol as well. That summary is the record that answers a question limited to parties, time, and byte counts. Content, a person's mail, and a file fingerprint answer other questions. "Session data for the parties, the time, and the byte count of that one retail flow". It is the flow summary of parties, time, and bytes, which is exactly the request. "Full packet payload that still holds every content byte carried in that flow last week". Payload is the content carried in the flow. The request does not ask for those bytes, and payload is a different data type from the session summary. "The body of an email a store manager sent while discussing that same flow last week". An email body is message text a person wrote. It is not the flow record of who talked to whom and how many bytes moved. "A malware hash that identifies a file and records nothing about who communicated". A malware hash identifies a file. It does not say which hosts communicated or how many bytes the flow moved. Exam caveat: session data can come from a flow record or a firewall log and still omit payload. Byte counts in that summary are not the file. Operational check: pull the flow record and confirm it shows the parties, the time, and the byte count, and that the payload is not the record you opened.