The SOC suspects a database server has been sending large volumes of data to an unfamiliar external IP address for the past month. Full packet capture is retained for only 48 hours. Which data source most efficiently shows which hosts talked to that address, when, and how many bytes moved during the month?
Select an answer to reveal the explanation.
Short Explanation
Flow data is the phone bill, not the recording of the call: who talked to whom, when, and for how long. When you need a month of byte counts to one address, the phone bill is exactly what you want. The trap is the packet capture, which has the call recordings but only for the last two days.
Full Explanation
NetFlow and IPFIX summarize conversations rather than storing their contents. Each flow record holds source and destination addresses, ports, protocol, start and end time, and packet and byte counts, so the records are small enough to keep for weeks or months. Querying them for the suspicious external address quickly shows which internal hosts communicated with it, the time pattern, and the total volume transferred, which is exactly what is needed to confirm and scope exfiltration over a month. Packet captures contain full payloads and are invaluable for seeing what was sent, but with only 48 hours retained they cannot show a month of activity, and searching raw captures for volume trends is far slower than querying flows. Database application logs show which queries were run and by whom, which may reveal what data was read, but they do not show network destinations or bytes leaving the network. Vulnerability scan results describe weaknesses on the server and might suggest how it was compromised, but they record nothing about traffic. Exam caveat: flow records lack payload, so once flows identify the window and hosts, a targeted packet capture or endpoint review is needed to see content. Operational check: query the flow collector for the external address over 30 days and total the bytes per internal source.