Exam 400-007 topic 1 question 108 discussion

Actual exam question from Cisco's 400-007

Question #: 108
Topic #: 1

A network security team uses a purpose-built tool to actively monitor the campus network, applications, and user activity. The team also analyzes enterprise telemetry data from IPFIX data records that are received from devices in the campus network. Which action can be taken based on the augmented data?

A. reduction in time to detect and respond to threats
B. integration with an incident response plan
C. adoption and improvement of threat-detection response
D. asset identification and grouping decisions

Show Suggested Answer

Suggested Answer: A 🗳️

by mostafabebers at April 20, 2023, 11:37 p.m.

Comments

Submit Cancel

bdp123

Highly Voted 1 year, 7 months ago

Selected Answer: A

IPFIX flow export devices are usually deployed are particularly useful for the detection of the range of advanced security threats including DDoS attacks, network scans, worm spreading, and botnet communication. https://blog.niagaranetworks.com/blog/ipfix-use-cases-in-network-monitoring-and-analysis

upvoted 7 times

Seawanderer

6 months, 3 weeks ago

while it seems correct, "reduction in time" is not an ACTION

upvoted 2 times

...

Devsin2000

Most Recent 3 months, 1 week ago

Selected Answer: C

The question is "what action". A - clearly is not an action but an outcome. That leaves B &C. However, C is action very much related to security. B perhaps is little more generic.

upvoted 1 times

...

sandccie

3 months, 3 weeks ago

Selected Answer: C

what not C - IPFIX data can improve threat-detection response by enhancing visibility, proactively identify suspicious behaviors and IoC, and providing actionable insights.

upvoted 2 times

...

Rollizo

11 months, 2 weeks ago

Selected Answer: B

You have a lot of new data then you need to integrate it with a tool

upvoted 2 times

...

yasglobal

1 year, 1 month ago

Selected Answer: B

the answer is B

upvoted 2 times

...

datastream

1 year, 6 months ago

the answer is B. From Cisco's perspective - "Internet Protocol Flow Information Export (IPFIX) is an IETF standard export protocol for sending Netflow packets. IPFIX is based on Netflow version 9. The IPFIX feature formats Netflow data and transfers the Netflow information from an exporter to a collector using UDP as transport protocol."

upvoted 4 times

...

mostafabebers

1 year, 8 months ago

Answer is B

upvoted 3 times

...