During an incident review, an analyst needs to reconstruct exactly which bytes crossed a virtual network segment, while a colleague needs to correlate authentication events across many hosts over the same window. Which statement correctly distinguishes the two techniques they are using?
- APacket capture aggregates event records from multiple sources, while log correlation records full network payloads for deep inspection
- BPacket capture records full network payloads for deep inspection, while log correlation aggregates event records from multiple sources to reveal patterns Correct
- CBoth techniques reconstruct full packet payloads, differing only in whether they run in real time or in batch
- DBoth techniques summarise event metadata, differing only in whether they store data on the host or in the network
Why A is wrong: Tempting because it uses the right vocabulary, but the two definitions are transposed: capture handles payloads and correlation handles aggregated events, not the reverse.
Why B is correct: Correct: packet capture preserves the actual traffic content for byte-level analysis, whereas log correlation joins discrete event records across systems to surface relationships neither log shows alone.
Why C is wrong: Plausible since both aid investigation, but log correlation works on summarised event records rather than raw payloads, so the claim that both reconstruct packets is wrong.
Why D is wrong: Attractive because storage location is a real distinction elsewhere, but packet capture stores full payloads rather than summarised metadata, so this understates what capture provides.