試験312-50v13-JPN トピック1 問題26 スレッド

A Protocol Analyzer is the correct tool used to examine the contents of packet data (often stored in .pcap files) to determine if a particular sequence of traffic is suspicious, malformed, or part of a known exploit.
In CEH v13:
Module 3: Scanning Networks
Module 4: Enumeration
Module 5: Vulnerability Analysis
Related Lab: Packet Analysis using Wireshark
The CEH v13 Study Guide states:
"A protocol analyzer (e.g., Wireshark) captures and decodes packets to display their contents and help analysts understand communication flows and anomalies. It is used to manually inspect packet contents and behavior, which helps distinguish legitimate traffic from attacks." PCAP (Packet Capture) files are typically analyzed using tools like Wireshark. These tools decode protocol layers and show payloads, making it easier for analysts to identify if IDS alerts were accurate or false positives.
Incorrect Options:
B). Network sniffer: General term; protocol analyzer is the specific functional tool used.
C). IPS: Prevents or blocks malicious traffic, but does not analyze existing packet captures.
D). Vulnerability scanner: Identifies vulnerabilities on systems/services; not used for packet capture review.
Reference:CEH v13 Study Guide - Module 3: Scanning Networks, "Using Packet Capture and Protocol Analysis Tools"CEH iLabs: "Network Scanning and Protocol Analysis with Wireshark"
======