17. During an investigation a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has occurred. Which of the following would best help the analyst determine this?
Answer: D
Packet capture would best help the analyst determine if data exfiltration has occurred.
Packet capture allows the security analyst to capture and analyze the actual data being transmitted over the network, enabling them to see whether any sensitive information has been sent to the command-and-control server.
A) Application log
Application logs provide information about the activities and transactions occurring within an application but may not contain detailed insights regarding network traffic or data being sent to external servers. Therefore, while they can offer some context, they are not the best source for determining if data exfiltration has occurred.
B) Metadata
Metadata refers to data that provides information about other data, such as timestamps or file sizes. While it may offer some insights into the characteristics of data transfers, it lacks the granularity needed to identify specific instances of exfiltrated data, making it less useful for the analyst's investigation.
C) Network log
Network logs record traffic flows and can indicate connections to external servers, but they do not provide detailed content information. This means that while they can show that communication occurred, they cannot confirm whether sensitive data was actually exfiltrated.
D) Packet capture
Packet capture is the most effective method for determining potential data exfiltration, as it allows the analyst to inspect the contents of the packets being transmitted. This means they can directly observe whether any data was sent to the command-and-control server, making it the best option for this investigation.
Conclusion
Packet capture is superior for detecting data exfiltration because it reveals the actual data being transmitted, unlike application logs, metadata, or network logs, which either lack detail or provide insufficient context. By analyzing packet captures, the analyst can definitively determine if sensitive information has been compromised and sent out to unauthorized servers.