最高情報セキュリティ責任者は、会社のサーバーを監視して SQLi 攻撃が発生しないか確認し、攻撃が発生した場合に包括的な調査を行えるようにしたいと考えています。会社では、トラフィックの監視を可能にするために SSL 復号化を使用しています。この目標を達成するには、次のどの戦略が最適ですか。
正解:D
Full packet capture is a technique that records all network traffic passing through a device, such as a router or firewall. It allows for detailed analysis and investigation of network events, such as SQLi attacks, by providing the complete content and context of the packets. Full packet capture can help identify the source, destination, payload, and timing of an SQLi attack, as well as the impact on the server and database. Logging NetFlow traffic, network traffic sensors, and endpoint and OS-specific security logs can provide some information about network activity, but they do not capture the full content of the packets, which may limit the scope and depth of the investigation.