Question

The netflow collector that Sam's security team uses is capable of handling 1 gigabit of traffic per second. As Sam's organization has grown, it has increased its external network connection to a 2 gigabit per second external link and has begun to approach full utilization at various times during the day. If Sam's team does not have new budget money to purchase a more capable collector, what option can Sam use to still collect useful data?

A. Enable QoS
B. Enable netflow compression
C. Enable sampling
D. None of the above

Answer 1

Sam's team can enable sampling on their netflow collector to manage the increased network traffic without needing to purchase a more capable collector.

Step-by-step explanation:

Given the scenario where Sam's security team is limited by a netflow collector capability that is overshadowed by a higher volume of network traffic, the most practical solution, without additional budget for equipment upgrades, would be to enable sampling. Sampling involves collecting data on just a fraction of the packets passing through the network, thereby reducing the volume of the data to a level that the collector can handle. This allows the team to still gain insights into their network traffic patterns without overloading their current collector's capacity.