200-201 Question 120
Select 3A security analyst is monitoring network traffic and notices an unusual spike in encrypted outbound connections to TOR exit nodes. Which of the following actions should the analyst prioritize to investigate this activity?
- A
Identify the internal system initiating the TOR traffic.
- B
Block all outbound traffic to known TOR exit node IPs at the firewall.
- C
Examine the system for signs of malware or unauthorized software.
- D
Immediately disconnect the system from the network without further analysis.
- E
Alert the affected user and request an explanation for the activity.
Show answer and explanation
Correct answers: A, B, C
Explanation
When detecting unusual TOR traffic, the priority is to identify the source system, block its suspicious activity, and investigate for signs of compromise. These steps ensure both immediate threat mitigation and a deeper understanding of the root cause. Disconnecting the system or alerting users prematurely may lead to counterproductive actions or loss of evidence.
- A. Correct.
Identifying the internal system initiating the TOR traffic is critical for further investigation and containment. This provides insight into the source of the suspicious activity.
- B. Correct.
Blocking outbound traffic to known TOR exit nodes helps to mitigate the immediate risk of data exfiltration or further malicious actions using TOR.
- C. Correct.
Examining the system for signs of malware or unauthorized software is necessary to determine if the activity is the result of a compromise or unauthorized access.
- D. Incorrect.
Immediately disconnecting the system from the network without further analysis might disrupt legitimate activity unnecessarily and hinder forensic investigation.
- E. Incorrect.
Alerting the user without sufficient evidence may lead to false accusations or tipping off an insider threat, potentially complicating the investigation.