問題文
An analyst needs to confirm the exact bytes of a request that a server rejected, including the header the server complained about. Which capture approach provides that, and why?
選択肢
- A tcpdump capture on the path, because it writes the frames themselves rather than a summary of them.
- A flow export from the router, because a flow record carries the request line and the header names of every session it summarizes, which is what makes it small enough to keep for months while still answering questions about the content.
- A statistical report of request rates per minute, since the minute in which the rejection happened narrows the search down to one request.
- The server access log, because it records the reason each request was rejected together with the header that caused the rejection.