A security analyst has requested network engineers integrate sFlow into the SOC’s overall monitoring picture. For this to be a useful addition to the monitoring capabilities, which of the following must be considered by the engineering team?
A. Effective deployment of network taps
B. Overall bandwidth available at Internet PoP
C. Optimal placement of log aggregators
D. Availability of application layer visualizers
How to PASS CAS-004 in First Attempt?FULL Printable PDF and Software. VALID exam to help you PASS. |
 |
key word
“For this to be a useful addition to the monitoring capabilities,”
IMO
A & D both right
i think D is more accepted, according to COReY
“An application will be required to nicely present the data visually”
A. Effective deployment of network taps.
if you are taping the wrong locations, the information is not useful.
For me, as a Net Admin, sFlow will just about slow everything down, its a known issue. B talks about Overall bandwidth available but its to trick you if you don’t read the rest. Availability of application layer visualizers is the best answer, even though we all wish there was a definitive way to confirm its what comptia wants.
D – perhaps
yes – D
If you two agree on D, could you elaborate on why? I have tried to look up what that even means and I am not finding much on it. I was going with network taps (A) initially because to get sampled data flow for monitoring, then the placement of network taps to retrieve this data would be an important consideration right?
Hint – Security analyst. An application will be required to nicely present the data visually. If not then what is point of gathering all the data to begin with?
More like presenting the data with an application breakdown. However you want to read into it.