During a suspected data exfiltration from the county tax database, analysts need to identify which internal hosts are talking the most to unusual external destinations. Which tool best surfaces that traffic metadata?
Select an answer to reveal the explanation.
Short Explanation
NetFlow is like a toll booth log—who talked to whom and how much—without recording every word. When data might be sneaking out of the tax system, those top-talker records point you at the loud hosts first.
Full Explanation
NetFlow and similar IPFIX-style flow records summarize conversations—who talked to whom, over which ports and protocols, and how much volume—without requiring full packet payloads. During suspected exfiltration from the county tax database, top-talker and anomalous-destination views quickly highlight internal hosts shipping unusual bulk traffic outbound, guiding deeper packet capture, proxy review, or endpoint investigation. That metadata-centric monitoring tool is purpose-built for triage when analysts must find loud or weird paths through municipal networks under time pressure.
Disabling outbound firewalls so traffic-volume charts stay quiet removes protective controls and worsens exposure while destroying useful deny telemetry. Wiping switch counters before the investigation starts erases volume evidence investigators need. Asking citizens to email screenshots of slow tax-portal pages yields anecdotal performance feedback, not authoritative flow metadata for an exfiltration case.
Exam caveat: flows show metadata, not content. Confirm suspicious sessions with PCAP, TLS-intercept proxy logs, or EDR when legal authority and technical conditions allow. Establish baselines so “top talker” is judged relative to normal tax-system patterns, not absolute bytes alone.
Operational check: query flow collectors for the tax VLAN’s top egress talkers and newly seen external destinations during the incident window, isolate suspicious hosts, preserve flow archives for chain of custody, and correlate peaks with database audit logs and DLP alerts.