200-201 Question 142
Single answerYou are a cybersecurity analyst working in a Security Operations Center (SOC). You receive an alert from your SIEM system indicating a potential brute-force attack on a corporate server. The alert includes the following data: source IP address, destination IP address, timestamp, and the number of failed login attempts. What is the MOST appropriate action to take based on the alert data?
- A
Immediately block the source IP address to prevent further attempts.
- B
Correlate the alert with other logs to confirm the attack and validate its severity.
- C
Ignore the alert as it might be a false positive from the SIEM system.
- D
Reboot the affected server to mitigate any potential damage from the attack.
Show answer and explanation
Correct answer: B
Explanation
When dealing with alert data, especially from a SIEM system, it's crucial to validate the alert by correlating it with other logs and contextual information. This ensures that the alert is not a false positive and helps to assess the severity and scope of the issue before taking further action. Immediate actions like blocking IPs or rebooting systems should only be taken after confirming the nature of the incident.
- A. Incorrect.
Immediately blocking the source IP address without proper investigation could lead to unintended disruptions if the alert is a false positive. It's important to validate the alert first.
- B. Correct.
Correlating the alert with other logs helps confirm the attack and provides context about its severity. This is a critical step in ensuring appropriate response actions.
- C. Incorrect.
Ignoring the alert could lead to a missed opportunity to stop a legitimate attack, and it fails to follow proper incident response procedures.
- D. Incorrect.
Rebooting the affected server without confirming the nature of the attack is not a standard or effective response to a brute-force alert. It could disrupt legitimate operations.