An incident response team needs detailed packet contents for a specific investigation and has planned for the storage burden. Which method best fits that need?

### Why this is right Full-packet capture preserves complete packets and is described as the ideal method for detailed traffic analysis. Strategic deployment for specific use cases can address its storage and maintenance costs. ### The concept Different monitoring approaches retain different levels of evidence. Full-packet capture supports detailed examination of packet contents. NetFlow records origin, destination, and amount, which may be sufficient for many traffic analyses but does not provide the same complete packet detail. A response team should select capture depth based on the investigation need and available resources. ### The other options - **B. NetFlow alone.** NetFlow gives traffic-flow details but is not full-packet content capture. - **C. A user awareness report.** A user report may provide a detection signal but does not preserve packet contents. - **D. An EDR baseline.** A baseline describes expected endpoint behavior, not network packet contents. ### Terms - **Full-packet capture**: Recording complete network packets for detailed analysis. - **NetFlow**: Recording traffic origin, destination, and amount. ### Remember For packet contents, use packet capture; for flow summaries, consider NetFlow.