During a suspected data exfiltration from the county tax database, analysts need to identify which internal hosts are talking the most to unusual external destinations. Which tool best surfaces that traffic metadata?
Select an answer to reveal the explanation.
Short Explanation
NetFlow is like a toll booth log—who talked to whom and how much—without recording every word. When data might be sneaking out of the tax system, those top-talker records point you at the loud hosts first.
Full Explanation
NetFlow and related flow technologies export metadata about conversations (addresses, ports, volumes, timing) without necessarily capturing full payloads. Investigators use that metadata to spot unusual top talkers and destinations during suspected exfiltration. Disabling controls or discarding counters removes evidence; citizen screenshots do not replace network telemetry.