I85PREP
⌘ K
CCOA study materials
CCOA study resources

CCOA (ISACA): Network Traffic Analysis and Detection

CCOA · Work through your exam, one topic at a time.

All guide sections

Network Traffic Analysis and Detection

This domain tests whether you can move from raw packets and flow records to a defensible detection statement. Expect PCAP triage, flow-record pivoting, IDS alert validation, and protocol-level anomaly recognition.

Start with the data source, not the alert

  • Full packet capture answers content questions (payload, headers, certificates). Flow records answer volume, direction, and periodicity questions at scale.
  • Zeek logs are the analyst's index: conn.log (uid, orig/resp bytes, duration, conn_state), dns.log, http.log (user_agent, uri, status), ssl.log (SNI, JA3/JA3S), files.log.
  • Suricata/Snort give you a signature name and sid; confirm the triggering bytes before you write it up. Encrypted or evasive traffic can fire a signature on reassembly assumptions rather than real content.

Behaviors that carry signal

  • Beaconing: low jitter at a fixed interval, small request and larger response (or inverted). Baseline first; NTP, AV updates, and telemetry agents are also periodic.
  • DNS tunneling: long high-entropy labels, TXT/NULL record abuse, many unique subdomains under one parent, response sizes above normal.
  • Exfiltration: sustained asymmetric byte counts (outbound far exceeds inbound) on a host that should not be sending.
  • TLS anomalies: JA3/JA3S fingerprint that does not match the expected client, absent SNI, self-signed certs on an internal-looking domain.
  • Lateral movement: SMB/445 sessions between workstations, Kerberos service-ticket bursts (4769) from one account across many SPNs.

Worked example

Host 10.4.2.19 sends about one DNS query every 60 seconds to random subdomains of telemetry-sync[.]net. The labels are 40-character base32 strings, responses are TXT records averaging 312 bytes, Zeek dns.log shows 1,412 unique subdomains in six hours, and no HTTP or TLS from that host follows. Reasoning: fixed interval (beacon), high label entropy, TXT abuse, and unique-subdomain volume together indicate DNS tunneling rather than normal resolution. Confidence rises because the host has no other DNS activity and no proxy logs. Next pivots: are the resolved IPs known-bad, and which process issued the queries (Sysmon 22 or Zeek with process enrichment)?

Traps that cost marks

  • Labeling a port scan a flood without checking packet counts and TCP flags (SYN-only, half-open states).
  • Reading flow byte totals without direction and calling internal-to-internal SMB exfiltration.
  • Treating "high port" or "uncommon protocol" as malicious on its own.
  • Ignoring encryption: JA3 requires the ClientHello, so a mid-session capture will not produce it.
  • Believing an IDS alert without checking for retransmission or fragmentation evasion.