200-201 Question 100
Single answerAn organization is experiencing unusual network activity, and you are tasked with using NetFlow to investigate the issue. After examining the NetFlow records, you notice a high volume of traffic from a single IP address to multiple unknown external IP addresses on port 25. What could this indicate, and what is the primary step you should take to mitigate the situation?
- A
The IP address is likely a compromised host sending spam emails; isolate the host immediately.
- B
The IP address is likely being used for a Distributed Denial-of-Service (DDoS) attack; block all outgoing traffic on port 25.
- C
The IP address is performing legitimate email communication; no action is required.
- D
The IP address is likely scanning external IPs for vulnerabilities; shut down the host's network interface.
Show answer and explanation
Correct answer: A
Explanation
NetFlow is useful for identifying unusual traffic patterns, such as high-volume traffic on specific ports. In this scenario, the traffic characteristics on port 25 strongly suggest spamming behavior from a compromised host. Isolating the host prevents further unauthorized activity while allowing for further investigation and remediation.
- A. Correct.
Correct: A high volume of traffic on port 25 (SMTP) to multiple unknown IP addresses is a strong indicator of a compromised device being used for spam email distribution. Isolating the host is the best immediate step to contain the threat.
- B. Incorrect.
Incorrect: While a DDoS attack could involve high traffic, it usually targets a specific destination, not multiple external IPs. Blocking all outgoing port 25 traffic would disrupt legitimate email services for all users.
- C. Incorrect.
Incorrect: Legitimate email communication does not generate high-volume traffic to unknown external IPs. The observed behavior is suspicious and warrants action.
- D. Incorrect.
Incorrect: Scanning for vulnerabilities typically involves multiple ports and IPs, not just port 25. Shutting down the host's network interface is a drastic step and may not be necessary unless isolation fails.