Question

A SOC analyst is reviewing a suspected data exfiltration incident. The security team asks whether the current monitoring architecture allows them to reconstruct the actual contents of the files that left the network. The organization currently collects only NetFlow records exported from its core routers and does not maintain any packet capture appliances. Which statement BEST describes the analytical limitation of relying solely on this NetFlow data for this investigation?

Accepted Answer

NetFlow provides transactional metadata such as source/destination IPs, ports, protocol, and byte/packet counts, but it does not capture payload, so the file contents cannot be reconstructed

Answer

NetFlow captures full packet payloads by default, so the analyst can extract the transferred files directly from the flow records

Answer

NetFlow records include the application-layer session content, making a separate tap unnecessary for content reconstruction

Answer

NetFlow only records Layer 2 frame headers, so neither the five-tuple nor byte counts are available for analysis