200-201 Question 13
Select 3A security analyst is tasked with investigating an ongoing phishing attack targeting employees within their organization. The organization uses a SIEM and a SOAR platform for threat detection and incident response. Which of the following actions should the analyst take using the SIEM and SOAR to effectively respond to this incident?
- A
Use the SIEM to correlate log data from email gateways, endpoints, and firewalls to identify affected users.
- B
Manually alert individual users about the phishing attack by sending emails from the analyst's account.
- C
Deploy a SOAR playbook to automatically block the malicious phishing domain and quarantine affected endpoints.
- D
Search the SIEM for historical logs to identify patterns or previous instances of similar phishing campaigns.
- E
Use SOAR to generate a report and escalate the incident to senior management without taking further action.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively respond to a phishing attack, the analyst must utilize the SIEM to gather and correlate data from various systems to understand the attack's scope and impact. Additionally, leveraging the SOAR platform for automated response actions, such as blocking malicious domains and quarantining endpoints, ensures a timely and efficient containment of the threat. Historical log analysis using the SIEM adds value by identifying recurring patterns or related campaigns, further enhancing the organization's security posture.
- A. Correct.
Using the SIEM to correlate log data from multiple sources helps the analyst identify affected users and determine the scope of the phishing attack. This is a critical step in incident investigation.
- B. Incorrect.
Manually alerting users without proper automation or verification is inefficient and could lead to further issues, such as spreading misinformation or missing critical users.
- C. Correct.
Deploying a SOAR playbook allows for automated responses like blocking malicious domains and quarantining endpoints, which can significantly reduce the impact of the phishing attack.
- D. Correct.
Searching the SIEM for historical logs helps the analyst understand if the phishing campaign is part of a recurring attack and identify patterns for better threat hunting and response.
- E. Incorrect.
Generating a report and escalating without taking action does not address the immediate threat or help contain the phishing attack, making this approach insufficient in this scenario.