200-201 Question 131
Select 3A cybersecurity analyst is monitoring network traffic logs and notices a sudden surge in outbound traffic to an unfamiliar IP address. Upon further inspection, the analyst identifies that the data being transmitted includes sensitive customer information. Which data types could have been most useful in detecting and analyzing this incident?
- A
NetFlow data
- B
Threat intelligence feeds
- C
Endpoint logs
- D
DNS query logs
- E
Dark web monitoring reports
Show answer and explanation
Correct answers: A, C, D
Explanation
NetFlow data, endpoint logs, and DNS query logs are critical for detecting and analyzing unusual network activity. NetFlow data reveals traffic patterns, endpoint logs provide device-level insights, and DNS query logs help identify suspicious domains. Together, they provide a comprehensive view of the incident. Threat intelligence feeds and dark web monitoring reports, while valuable in other contexts, are less relevant for identifying and analyzing this specific traffic anomaly.
- A. Correct.
NetFlow data provides details about network traffic patterns, such as IP addresses, ports, and the volume of data transferred. This allows analysts to identify unusual traffic surges or communication with suspicious IPs.
- B. Incorrect.
Threat intelligence feeds give general information about known threats but are less useful for specific detection of anomalies in network traffic.
- C. Correct.
Endpoint logs capture activity on individual devices, such as file access or application usage, which could reveal unauthorized data transfer or compromise.
- D. Correct.
DNS query logs can help trace the domains being resolved, potentially identifying malicious or suspicious domains involved in the incident.
- E. Incorrect.
Dark web monitoring reports provide insights into stolen data being sold or shared online but are not directly related to detecting or analyzing the traffic surge in this specific scenario.