Question

During an investigation, an analyst needs to determine the exact HTTP URI and file content that a suspicious internal host requested from an external server. The SOC has access to both a NetFlow collector and a full-visibility SPAN/tap feed captured to PCAP. Which statement correctly compares what each data source can provide for this specific need?

Accepted Answer

NetFlow provides the flow's source/destination IPs, ports, protocol, byte and packet counts, and timestamps, but the tap/PCAP data is required to see the actual HTTP URI and reconstruct the transferred file content.

Answer

NetFlow records the full application-layer payload including the HTTP URI, so the tap/PCAP feed adds no additional value for this investigation.

Answer

The tap/PCAP feed only records connection metadata, while NetFlow is the only source that captures and stores full packet payloads for content reconstruction.

Answer

Both NetFlow and tap/PCAP capture identical data; the choice between them is purely a matter of storage cost, not content visibility.