CSA (312-39) SOC Simulation Lab
Scenario Context
You are a L2 SOC Analyst at HealthCorp. Over the last 15 minutes, your SIEM has generated multiple alerts regarding an internal application server (10.40.12.105) communicating with a known threat actor IP address associated with data brokering.
Our NetFlow logs confirm the connections are occurring over TCP port 80. However, the traffic is unencrypted, and the Incident Response Manager needs to know exactly what data is leaving the network. NetFlow only shows the metadata, not the payload. You need a capability to passively observe and record the exact contents of the traffic passing through the core switch.
Security Environment
Current visibility tools at your disposal:
Question
Expert Insight
1. What is happening
In our scenario, we have proof of communication (via NetFlow), but we lack the context of the payload. NetFlow is like a phone bill—it tells you who called who, when, and for how long. But to hear the actual conversation (to confirm if patient data is being exfiltrated), we must capture the actual packets. To do this, SOC analysts rely on configuring a SPAN port (port mirroring) or a network tap, and then utilize tools to capture that passing traffic.
2. Why the correct answer is correct
C. Network Sniffing is the precise term for passively monitoring and capturing packets (including headers and payloads) as they traverse a network. Tools like Wireshark, tcpdump, and Zeek operate by putting network interfaces into promiscuous mode to "sniff" traffic intended for other hosts.
3. Why other options are wrong
A. Network Scanning: This is an active technique (e.g., sending ICMP echoes or ARP requests) to discover live hosts. It generates traffic rather than passively capturing passing traffic.
B. DNS Footprinting: This involves querying DNS servers (using dig, nslookup, or host) to map a target's infrastructure. It does not monitor data packets on a local network.
D. Port Scanning: Similar to network scanning, this is the active process of probing a target host (using tools like Nmap) to identify open, closed, or filtered ports.
4. Real-world SOC application
When investigating a potential data breach, full packet capture (PCAP) is the ultimate source of truth. If a legacy internal application communicates over HTTP (unencrypted), capturing that traffic allows you to extract the exact files or database records being stolen. A typical SOC workflow might involve SSH-ing into a sensor and running: sudo tcpdump -i eth1 host 10.40.12.105 -w exfil_investigation.pcap
MINI LESSON: Flow Data vs. PCAP Storage
Junior analysts often ask: "Why don't we just capture everything all the time?"
The answer is storage constraints and compliance. Capturing full payloads for a 10 Gbps core network would fill petabytes of storage in days. Instead, SOCs retain NetFlow (metadata) for months or years, but only use Network Sniffing (PCAP) dynamically via BPF (Berkeley Packet Filters) on specific choke points when an incident triggers, or they maintain rolling PCAPs that overwrite themselves every 24-48 hours.
Master SOC Analysis & Network Defense
Prepare for your EC-Council CSA with scenario-based labs.
Explore more CSA simulations