A city’s SOC cannot tell whether large outbound transfers from a records office are backups or exfiltration because no flow telemetry is collected on core egress. Which design addition best improves detection and fault awareness?
Select an answer to reveal the explanation.
Short Explanation
Without flow logs, the SOC is flying with a covered windshield. You don’t need every packet forever—just enough metadata to spot 'why is records office shipping terabytes to a strange place at 2 a.m.?'
Full Explanation
Without flow telemetry on core egress, the municipal SOC cannot distinguish authorized backup windows from silent exfiltration of records-office data. NetFlow, IPFIX, or equivalent metadata at egress and other chokepoints provides volume, destination, timing, and conversation summaries without necessarily retaining full packets forever. Retaining that metadata long enough for analysis and alerting on anomalies relative to known backup schedules turns outbound transfer patterns into detectable events. Flow visibility is foundational for both intrusion detection and operational fault awareness when large transfers suddenly appear toward unexpected destinations.
Increasing WAN circuit size alone assumes capacity upgrades remove the need for visibility; bigger pipes can simply move more stolen data faster without explaining who talked to whom. Disabling egress logging to avoid storing destination addresses that might relate to personal data discards security telemetry wholesale—privacy-preserving retention and minimization are preferable to blindness. Mirroring only HTTP headers from public websites while ignoring internal-to-Internet flows watches the wrong traffic class and misses the records-office egress path that matters.
Exam caveat: CISSP network monitoring expectations include flow or equivalent telemetry for anomaly detection; privacy concerns refine how logs are retained and protected, they do not justify turning detection off. Capacity is not a substitute for observability.
Operational check: enable flow export on egress routers and critical chokepoints to a hardened collector; baseline backup windows and destinations; alert on off-hours terabyte-scale transfers to new ASNs or countries; protect flow stores as sensitive operational data; and periodically validate that shadow IT or misconfigured servers still produce flows the SOC can see.