A court IT team suspects large data exfiltration, but application logs do not show transfer volume. Which sources are most appropriate to estimate egress?
Select an answer to reveal the explanation.
Short Explanation
When app logs shrug about how much left the building, NetFlow and packet captures are the highway traffic counters. They show volume and where the bits drove off to. Badge printers and whiteboard photos will not measure exfil.
Full Explanation
Estimating data exfiltration volume when application logs lack transfer metrics requires network-centric sources. Packet captures can show payload sizes, protocols, and destinations for sessions of interest, while NetFlow or IPFIX metadata summarizes bytes, packets, endpoints, and ports at scale without full payloads. Together—or either, depending on tooling—they let a court IT team quantify egress toward suspicious external hosts during the suspected window, even when the application never logged upload size. Flow records are especially useful for long retention and wide coverage; PCAP supports deep confirmation of content and protocol abuse when stored selectively.
HR performance reviews stored offline speak to personnel evaluation, not network egress. Physical visitor badge printer logs may show building entry but not bytes leaving the court’s digital systems. Whiteboard photos from a change-advisory meeting are informal change notes without traffic measurement. Exam caveat: when the stem emphasizes volume and destinations of exfiltration, choose packet or flow telemetry over unrelated administrative artifacts. Operationally, ensure border NetFlow/IPFIX is collected for court data-center egress, retain it long enough for IR, and have a playbook to start targeted packet capture on suspect hosts or segments when exfiltration is hypothesized—then compare destinations against allowlists and threat intelligence.