Question

A security operations team wants to detect anomalous behavior across the enterprise network without deploying packet-capture appliances on every segment. They plan to collect flow telemetry from routers and switches into a network traffic analysis platform. Which benefit of network telemetry most directly supports their goal of spotting deviations from normal traffic patterns?

Accepted Answer

It establishes behavioral baselines from aggregated flow metadata so that later deviations, such as unusual peer-to-peer connections or data volumes, can be flagged as anomalies

Answer

It decrypts TLS-encrypted payloads inline so analysts can read the full contents of every session traversing the core

Answer

It enforces 802.1X authentication on switch ports to prevent unauthorized endpoints from generating traffic

Answer

It stores complete packet payloads for every conversation, enabling full forensic reconstruction of file transfers