100-160 Question 188
Select 4You are a cybersecurity technician analyzing potential vulnerabilities in your organization's network. During your investigation, you notice unusual outbound traffic communicating with an IP address flagged in a threat intelligence feed. Which of the following actions should you take to identify potential vulnerabilities related to this activity?
- A
Correlate the flagged IP address with known Indicators of Compromise (IOCs) from threat intelligence reports.
- B
Monitor all outbound traffic to identify other suspicious communication patterns.
- C
Immediately block all incoming and outgoing traffic to the flagged IP address without further investigation.
- D
Use threat intelligence feeds to identify the nature of the flagged IP address (e.g., malicious domain, botnet activity).
- E
Perform a vulnerability scan on devices communicating with the flagged IP address to check for unpatched flaws.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Using threat intelligence techniques involves correlating suspicious activity with known threats, monitoring unusual patterns, and investigating the root cause. While immediate blocking might seem like a quick solution, it does not address the underlying vulnerabilities or provide insight into the nature of the threat. A combination of correlation, traffic monitoring, threat intelligence analysis, and vulnerability scanning is the best approach to identify and mitigate potential network vulnerabilities effectively.
- A. Correct.
Correlating the flagged IP address with known Indicators of Compromise (IOCs) helps determine if the activity is associated with a known cyber threat, making it a crucial step in vulnerability identification.
- B. Correct.
Monitoring outbound traffic can reveal additional suspicious communication patterns, which may indicate compromised devices or misconfigurations in the network.
- C. Incorrect.
Blocking traffic to the flagged IP address without investigation could disrupt legitimate services or miss identifying the root cause of the vulnerability.
- D. Correct.
Using threat intelligence feeds to determine the nature of the flagged IP address helps you understand the threat (e.g., malware, phishing, botnet) and its potential impact on the network.
- E. Correct.
Performing a vulnerability scan on devices communicating with the flagged IP address can reveal unpatched software or misconfigurations that attackers might exploit.