Question

A security team at a mid-sized company has firewalls at the internet edge but reports that an attacker moved undetected between internal servers for weeks before being discovered. Management asks the team to improve internal visibility without deploying inline security appliances on every internal link. The team decides to enable NetFlow export from internal switches and routers to a flow-analysis collector. Which benefit of network telemetry BEST addresses the team's specific problem?

Accepted Answer

It provides visibility into east-west traffic flows and behavioral baselines, enabling detection of anomalous lateral movement.

Answer

It decrypts TLS sessions between servers so payloads can be inspected for malware signatures.

Answer

It blocks malicious connections in real time as an inline enforcement point on each internal link.

Answer

It captures full packet payloads for every internal conversation to reconstruct exfiltrated files.