A network security monitoring analyst wants to understand what percentage of network sessions are encrypted on the enterprise network. Which Zeek log provides the most direct answer?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because ssl.log records all sessions where Zeek identified TLS/SSL, and dividing this count by total conn.log entries (or comparing service fields) gives the encryption percentage; using both methods cross-validates the result. A alone partially works by filtering conn.log service=ssl but may miss some encrypted sessions.
Full explanation below image
Full Explanation
C is correct because ssl.log records all sessions where Zeek identified TLS/SSL, and dividing this count by total conn.log entries (or comparing service fields) gives the encryption percentage; using both methods cross-validates the result. A alone partially works by filtering conn.log service=ssl but may miss some encrypted sessions. B alone counts ssl.log entries as encrypted sessions, which is accurate for TCP but may miss UDP-based encrypted protocols. D is wrong because http.log only captures HTTP/HTTPS web traffic, not all encrypted network traffic (SMTP over TLS, IMAPS, LDAPS, etc.).