92.0k views
1 vote
Lucca wants to identify systems that may have been compromised and are being used for data exfiltration. Which of the following technologies should he put into place to capture data that he can analyze using his SIEM to find this behavior?

A. A firewall
B. A netflow collector
C. A honeypot
D. A BGP monitor

1 Answer

3 votes

Final answer:

A netflow collector is the technology that Lucca should put into place to capture network traffic for analysis using a SIEM system to identify compromised systems being used for data exfiltration.

Step-by-step explanation:

Lucca is looking to identify systems that may have been compromised and are being used for data exfiltration. To capture data for analysis using a Security Information and Event Management (SIEM) system, the most appropriate technology to put into place would be B. A netflow collector.

This technology collects IP network traffic as it enters or exits an interface. By analyzing the flow data, it is possible to determine the source, destination, volume, and type of traffic on a network, which can be useful for identifying anomalies that could indicate data exfiltration.

Firewalls, while essential for network security, are more about controlling access than monitoring traffic. Honeypots are used to attract attackers to monitor their behaviors, rather than to analyze legitimate network traffic. BGP monitors are specifically for viewing changes in network routes, which is less relevant to detecting compromised systems used for data exfiltration.

Therefore answer is B. A netflow collector.

User Matt Jacobsen
by
7.9k points