100-160 Question 230
Select 3A cybersecurity analyst is using both a SIEM and a SOAR platform to monitor network activity. During a routine analysis, they notice an unusual spike in outbound traffic to an unknown IP address. Which of the following actions should they take to investigate and respond effectively?
- A
Analyze the packet captures to determine the nature of the outbound traffic.
- B
Use the SOAR platform to automate blocking of the suspicious IP address immediately.
- C
Review the SIEM logs to identify systems communicating with the suspicious IP address.
- D
Ignore the alert, as it might be a false positive.
- E
Correlate the event with threat intelligence feeds in the SIEM to determine if the IP is malicious.
Show answer and explanation
Correct answers: A, C, E
Explanation
When investigating a potential security incident, it is essential to use tools like SIEM and SOAR effectively. SIEM logs and packet captures provide insights into the nature and scope of the suspicious activity, while threat intelligence feeds help determine the malicious intent of entities involved. Immediate blocking actions should only be taken after sufficient analysis to avoid disrupting legitimate operations.
- A. Correct.
Analyzing packet captures can help determine whether the traffic contains sensitive data or malicious activity, making this a critical step in investigation.
- B. Incorrect.
Blocking the IP address immediately without further investigation could disrupt legitimate traffic and is not a recommended first step.
- C. Correct.
Reviewing SIEM logs helps identify affected systems and provides context about the scope of the incident, which is essential for a thorough investigation.
- D. Incorrect.
Ignoring the alert can lead to missing a potential security incident and is not a cybersecurity best practice.
- E. Correct.
Correlating the event with threat intelligence feeds in the SIEM can provide valuable information about whether the IP address is associated with known malicious activity.