Cert Master

KT-NET Traffic inspection

Encrypted traffic to a newly registered domain spikes after a phishing click. BEST correlation?

Multiple choice — select one answer

Answer choices

  1. a. Patch catalog version, without security or identity team coordination per policy.
  2. b. CCTV only, without security or identity team coordination per policy.
  3. c. Proxy, DNS, and EDR timelines within the same hour
  4. d. Invoice approval chain, without security or identity team coordination per policy.

Architectural breakdown & explanation

Multi-log correlation links user action to C2 establishment.

Correct answer(s): c. Proxy, DNS, and EDR timelines within the same hour

Exam domain: Traffic inspection (16% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications