Question

A SOC analyst is investigating a suspected data exfiltration event. Reviewing the perimeter sensor, she can see the source and destination IP addresses, ports, and the volume of bytes transferred, but the sensor cannot show the actual contents of the transferred files because the traffic uses TLS. Which statement best describes the impact of this encryption on the analyst's data visibility?

Accepted Answer

Encryption obscures the payload contents, so the analyst must rely on metadata such as flow volume, endpoints, and timing rather than inspecting the transferred data itself

Answer

Encryption prevents any network-based monitoring, so no useful data can be collected from the session at all

Answer

Encryption only affects endpoint agents and has no impact on network sensor visibility

Answer

Encryption increases payload visibility because TLS metadata reveals the plaintext of every packet