100-160 Question 233
Select 3You are a cybersecurity technician monitoring network data through a company's SIEM system. The system generates an alert for unusual traffic patterns from a specific IP address, showing a large number of outbound connections in a short period. Which actions would be most appropriate to take using the SIEM and SOAR platforms to investigate this potential incident?
- A
Analyze the packet captures associated with the flagged IP address for suspicious patterns.
- B
Ignore the alert since the SIEM system sometimes generates false positives.
- C
Check the log files for authentication attempts or system access from the flagged IP address.
- D
Use the SOAR platform to automatically block all traffic from the flagged IP address without further investigation.
- E
Correlate this alert with other logs from the SIEM system to determine if the behavior aligns with known attack patterns.
Show answer and explanation
Correct answers: A, C, E
Explanation
SIEM and SOAR platforms play critical roles in identifying and responding to security incidents. In this scenario, analyzing packet captures, checking logs, and correlating alerts help validate whether the flagged activity represents a real threat. These steps ensure a comprehensive investigation before taking response actions, avoiding premature decisions like blocking traffic unnecessarily.
- A. Correct.
Analyzing packet captures is a key step in identifying whether the flagged traffic contains malicious or suspicious activity, such as data exfiltration or malware communication.
- B. Incorrect.
Ignoring the alert is not a good security practice, as it could allow a potential threat to go unnoticed and escalate further.
- C. Correct.
Reviewing log files for authentication attempts or access from the flagged IP address can help determine whether the activity is part of a larger attack or unauthorized access.
- D. Incorrect.
Blocking all traffic from the flagged IP address without investigation may disrupt legitimate activity and does not align with best practices for incident response.
- E. Correct.
Correlating the alert with other logs is an essential step to understand the broader context and to determine if this is part of a coordinated attack or an isolated event.