What is the practical benefit of identifying credentials in a capture?

• A. Determine network topology
• B. Increase throughput
• C. Encrypt data
• D. Quickly identify leaked usernames/passwords

Answer: (D)

Identifying credentials in a capture directly supports incident response by revealing which accounts were exposed and where the breach may have originated. When traffic contains credentials in the clear (as with some protocols or weakly protected transmissions), you can see the exact usernames and passwords, which lets you quickly rotate affected credentials, revoke sessions, and alert users or owners to the breach. This practical visibility is what enables rapid containment and remediation. Other choices don’t fit because topology, throughput, or encryption goals aren’t about exposing user credentials in traffic—their purpose is different, and credentials in the capture don’t inherently provide those insights.