Exam CFR-310 topic 1 question 67 discussion

A. Unusual network traffic. Tcpdump is a packet-sniffing tool that captures network traffic in real-time. It allows you to analyze packets on a network, which can help detect unusual network traffic that may indicate an attack or compromise, such as spikes in data flow, suspicious IP addresses, or unexpected types of network traffic. Here’s why the other options don't fit as well: B. Unknown open ports: While Tcpdump captures traffic, it’s not primarily used to scan for open ports; tools like Nmap are better suited for that. C. Poor network performance: Tcpdump doesn’t measure performance directly; it captures traffic for analysis. Performance issues would typically be detected with different monitoring tools. D. Unknown use of protocols: Tcpdump can show you the protocols in use, but detecting unknown protocols would require deeper analysis of the traffic and isn't its main focus.