What is the purpose of placing a network sniffer during a security assessment?

• A. To perform vulnerability scanning against hosts.
• B. To block unauthorized traffic.
• C. To capture and analyze traffic for potential security issues.
• D. To encrypt all network communications.

Answer: (C)

Capturing and inspecting what travels over the network is the primary purpose of a network sniffer in a security assessment. By placing the tool on a network segment or a mirror/tap, you can observe packets as they flow and dissect headers and payloads to spot potential issues, such as unencrypted credentials, insecure protocols, misconfigurations, or signs of malicious activity. This live visibility lets you verify how data moves, identify leakage or policy violations, and assess whether security controls are effectively protecting traffic in transit. Remember, a sniffer analyzes traffic; it doesn’t block traffic, and it doesn’t encrypt communications. If traffic is encrypted, you may still glean useful information from metadata and timing, but content may not be readable without encryption keys.