問題文
An architect must choose what to collect in order to identify the pair of hosts that exchanged the most data between 02:00 and 03:00 last night. Interface counters are already collected every 60 seconds. What should be added, and why?
選択肢
- A shorter polling interval for the interface counters, because sampling every five seconds instead of every sixty gives enough resolution to identify which pair of hosts was responsible for the peak that appeared during that hour.
- Full packet captures on every link, since they contain the most detail and let the pair of hosts be read straight out of the recorded headers.
- Device log messages, because they record when traffic patterns change.
- Per-conversation flow records, because interface counters give totals per link and cannot attribute volume to a pair of hosts.