100-160 Question 190
Single answerYou are tasked with assessing your organization's network vulnerabilities using threat intelligence techniques. After reviewing external threat intelligence feeds, you identify IP addresses associated with known malicious actors. What is the next best step you should take to address potential network vulnerabilities?
- A
Block the identified IP addresses at the firewall level immediately.
- B
Conduct a vulnerability scan to check for potential exposure to the threats.
- C
Monitor the identified IP addresses for future activity without taking further action.
- D
Report the IP addresses to law enforcement before taking any steps on your network.
Show answer and explanation
Correct answer: B
Explanation
Using threat intelligence techniques involves not just identifying potential threats but also taking actionable steps to evaluate and mitigate risks. Conducting a vulnerability scan after identifying malicious IP addresses ensures that you assess your network's exposure and determine the best course of action to mitigate vulnerabilities effectively.
- A. Incorrect.
Blocking the identified IP addresses at the firewall level immediately may seem proactive, but without further understanding of your network's exposure, this action could lead to operational disruptions or incomplete mitigation.
- B. Correct.
Conducting a vulnerability scan helps determine whether your systems are exposed to the threats associated with the malicious IP addresses. This approach is methodical and ensures you gather more context before taking action.
- C. Incorrect.
Monitoring the identified IP addresses for future activity without taking further action is not sufficient, as it delays addressing potential vulnerabilities and leaves your network exposed.
- D. Incorrect.
Reporting the IP addresses to law enforcement is not the immediate priority in this situation. While it may help in broader cybersecurity efforts, your first responsibility is to safeguard your organization's network.