Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Network SecurityMedium
A security analyst is investigating a suspected malware infection that is attempting to communicate with a Command and Control (C2) server over a non-standard port. The analyst needs to identify the source and destination IP addresses, port numbers, and protocol used in these suspicious communications. Which network security tool is best suited for real-time packet capture and analysis?
- APacket Sniffer (e.g., Wireshark)
- BVulnerability Scanner
- CSecurity Information and Event Management (SIEM)
- DNetwork Intrusion Detection System (NIDS)
Show answer & explanationAnswer & explanation
Correct answer: A. Packet Sniffer (e.g., Wireshark)
A packet sniffer like Wireshark allows for detailed, real-time capture and analysis of network traffic at the packet level, which is essential for identifying specific communication parameters like IP addresses, ports, and protocols.
Why the other options are wrong
- B. A vulnerability scanner identifies security weaknesses in systems and applications, but it does not capture or analyze live network traffic.
- C. A SIEM gathers and analyzes logs from various sources, but it does not perform real-time, deep packet inspection itself.
- D. A NIDS monitors network traffic for suspicious activity and generates alerts, but it typically doesn't provide the granular, raw packet capture and analysis capabilities needed for detailed investigation by an analyst.
Packet Sniffer
A tool (software or hardware) used to intercept and log traffic passing over a digital network or part of a network.
- Allows for deep inspection of individual packets.
- Useful for network troubleshooting, security analysis, and protocol development.
- Examples include Wireshark, tcpdump.
Memory trick: Different tools for different insights into network health and security.