A security analyst uses a full pcap solution to extract all traffic from the last...

Option D applies the correct packet-filtering logic to isolate DNS-related traffic associated with the suspected server . The -r suspicious.pcap option directs tcpdump to read packets from the existing PCAP rather than capture live traffic. The expression port 53 and host 10.213.4.27 then limits output to packets involving the specified system and DNS's conventional port 53.

This is directly relevant to suspected DNS exfiltration. Attackers can encode data within DNS queries or responses, including unusually long subdomains or other manipulated DNS fields. Isolating the target's port 53 traffic dramatically reduces the dataset and allows the analyst to examine relevant queries and responses for encoded or anomalous information.

strings suspicious.pcap | grep treats the capture primarily as raw printable data and does not accurately perform protocol-aware packet filtering. The Zeek option searches file.log, which is focused on files observed in network traffic and is not the most direct location for DNS-query analysis. The Snort syntax shown is also inappropriate for the required extraction workflow.

The essential skill is translating an investigative hypothesis— possible DNS exfiltration by a known host —into a precise PCAP filter.

Study Guide Reference: Security Operations → Network Traffic Analysis → Full Packet Capture → tcpdump → BPF Filters → DNS Analysis → Data Exfiltration Detection.