Cert Master

KT-NET Traffic inspection

Netflow shows large outbound transfers at 3 a.m. to a cloud storage API. Next step?

Multiple choice — select one answer

Answer choices

  1. a. Assume backup and ignore, without security or identity team coordination per policy.
  2. b. Delete netflow to save space, without security or identity team coordination per policy.
  3. c. Block all cloud globally, without security or identity team coordination per policy.
  4. d. Identify process/user via EDR and verify against backup/job schedules

Architectural breakdown & explanation

Validate against known jobs; anomalies may be exfiltration.

Correct answer(s): d. Identify process/user via EDR and verify against backup/job schedules

Exam domain: Traffic inspection (16% weight on the official guide).

Official documentation & study links

Practice this certification

This page is one question from the KeyTrain's Key Training — Network Security bank. Run a full timed practice exam with domain-weighted random questions in your browser.

Start practice exam View exam overview All certifications