Which option correctly identifies the two tools that can detect anomalous behavior, command and control traffic, and infected hosts when used together?

Which option correctly identifies the two tools that can detect anomalous behavior, command and control traffic, and infected hosts when used together?

• A. Intrusion Detection System
• B. NetFlow
• C. Intrusion Detection System and NetFlow
• D. Antivirus Software

Answer: (C)

This question hinges on how combining different network-monitoring tools expands visibility to catch tricky signs like anomalous behavior, command-and-control traffic, and infected hosts. An Intrusion Detection System analyzes traffic for known attack signatures and suspicious patterns, triggering alerts when something looks off. NetFlow, on the other hand, provides metadata about traffic—who talked to whom, when, and how much data was exchanged—highlighting unusual communication patterns, beaconing to external destinations, or flows that don’t fit normal behavior. Used together, they cover both content-based signals and traffic-pattern signals. The IDS can raise alerts based on suspicious payloads or protocol misuse, while NetFlow reveals the broader picture of network activity, such as many small, regular connections to an unusual external host or rapid beaconing that suggests a host is communicating with a command-and-control server. This combined view makes it much more effective at spotting infected machines and C2 traffic than either tool alone. Antivirus software is focused on host-level malware detection, not on shaping network-wide visibility for anomalous traffic or C2 patterns, so it doesn’t provide the same combined insight across the network.

This question hinges on how combining different network-monitoring tools expands visibility to catch tricky signs like anomalous behavior, command-and-control traffic, and infected hosts. An Intrusion Detection System analyzes traffic for known attack signatures and suspicious patterns, triggering alerts when something looks off. NetFlow, on the other hand, provides metadata about traffic—who talked to whom, when, and how much data was exchanged—highlighting unusual communication patterns, beaconing to external destinations, or flows that don’t fit normal behavior.

Used together, they cover both content-based signals and traffic-pattern signals. The IDS can raise alerts based on suspicious payloads or protocol misuse, while NetFlow reveals the broader picture of network activity, such as many small, regular connections to an unusual external host or rapid beaconing that suggests a host is communicating with a command-and-control server. This combined view makes it much more effective at spotting infected machines and C2 traffic than either tool alone.

Antivirus software is focused on host-level malware detection, not on shaping network-wide visibility for anomalous traffic or C2 patterns, so it doesn’t provide the same combined insight across the network.