100-160 Question 231
Single answerA cybersecurity analyst is using a Security Information and Event Management (SIEM) tool to monitor network traffic and log files in real-time. They notice repeated failed login attempts from a single IP address, followed by a successful login attempt. They suspect this activity might be a brute force attack. Which action should the analyst take next using the SIEM or a Security Orchestration, Automation, and Response (SOAR) platform?
- A
Investigate the source IP address and isolate it if deemed malicious.
- B
Immediately block all incoming traffic to the network.
- C
Ignore the activity since the login was eventually successful.
- D
Manually notify all users to change their passwords.
Show answer and explanation
Correct answer: A
Explanation
SIEM tools are used to monitor network events and log data to identify suspicious activities, such as repeated failed login attempts followed by a success, which might indicate a brute force attack. The next step is to investigate the source and isolate it if it poses a threat. SOAR platforms can automate responses like isolating malicious IPs, reducing the time to mitigate threats. Immediate blocking of all traffic or notifying all users would be overreactions or unnecessary in this context.
- A. Correct.
Investigate the source IP address and isolate it if deemed malicious: This is the correct step. The analyst should use the SIEM or SOAR platform to gather more information about the source IP address, analyze patterns, and isolate it if it is confirmed to be malicious.
- B. Incorrect.
Immediately block all incoming traffic to the network: This is an overly aggressive action and not appropriate for this situation. Blocking all incoming traffic would disrupt legitimate operations.
- C. Incorrect.
Ignore the activity since the login was eventually successful: This is incorrect because the failed login attempts followed by a successful one could indicate a brute force attack, which requires investigation.
- D. Incorrect.
Manually notify all users to change their passwords: This is not the most efficient or relevant step in this scenario. The issue is specific to one suspicious IP, not all users.