200-201 Question 62

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  the answer is correct. Snort is IDS, as Zeek, which has a transaction data. Umbrella is a DNS security tool that monitor the connections of urls.

• 2

  Session data is associated with stateful firewalls. Full packet capture can be performed using tools like tcpdump. Transaction data is a more general term and is not specifically associated with Cisco Umbrella. Snort is an intrusion detection/prevention system and can detect connection events among other types of network activity.

• 1

  Session data: Session data refers to information about network sessions, including data such as the source and destination IP addresses, source and destination ports, protocol used, and the duration of the session. This type of data is typically generated by stateful firewalls, which keep track of the state of network connections. Full packet capture: Full packet capture refers to capturing all the data that is transmitted over a network, including the packet headers and payloads. This type of data is typically captured using packet capture software or appliances such as Wireshark or tcpdump. Transaction data: Transaction data refers to data generated by a network application when a transaction occurs, such as a web server log recording a user's access to a website. Connection event: A connection event refers to an event in which a device initiates or receives a connection attempt, such as a TCP SYN packet. This type of event is typically captured by network flow analysis tools like NetFlow or sFlow collectors or Snort.