100-150 Question 257
Single answerA company's network administrator notices unusual traffic patterns originating from an internal workstation. The traffic appears to be connecting to multiple unknown IP addresses on the internet. Which security measure should the administrator prioritize to investigate and mitigate this issue?
- A
Enable port security on all network switches.
- B
Quarantine the affected workstation and analyze its activity.
- C
Deploy a firewall rule to block all internet traffic from the workstation.
- D
Upgrade the workstation's antivirus software to the latest version.
Show answer and explanation
Correct answer: B
Explanation
Quarantining the affected workstation is the best first step because it isolates the potential threat, preventing further damage to the network. This also allows the administrator to investigate the suspicious traffic and determine whether the workstation has been compromised, while minimizing the risk to other systems. Other measures like blocking traffic or upgrading antivirus software may follow, but they do not address containment and investigation as effectively.
- A. Incorrect.
Port security controls access to switch ports but will not address a compromised workstation already connected to the network.
- B. Correct.
Quarantining the affected workstation isolates it from the network, preventing further malicious activity and allowing for detailed analysis of the issue.
- C. Incorrect.
Blocking all internet traffic from the workstation is a reactive measure that does not address the root cause or allow for proper investigation.
- D. Incorrect.
Upgrading antivirus software is a good practice but will not immediately stop the suspicious activity or provide insight into the current issue.