200-201 Question 143
Select 3A cybersecurity analyst is reviewing alert data from a Security Information and Event Management (SIEM) system. They notice a high volume of alerts triggered by failed login attempts from multiple IP addresses targeting a specific server over a short period of time. Which of the following steps should the analyst prioritize to determine the nature of the incident?
- A
Correlate the alerts with threat intelligence sources to identify potential malicious IP addresses.
- B
Immediately block all IP addresses associated with the failed login attempts.
- C
Analyze the server's authentication logs to confirm the alert details.
- D
Ignore the alerts if the server appears to be functioning normally.
- E
Check for other related alerts in the SIEM to identify potential patterns or trends.
Show answer and explanation
Correct answers: A, C, E
Explanation
To effectively handle the alert data, the analyst must prioritize actions that provide context, validate the alert's accuracy, and identify potential patterns. Correlating the alerts with threat intelligence, verifying the alert details in authentication logs, and looking for related alerts in the SIEM are critical steps in determining whether the activity is malicious and part of a larger attack.
- A. Correct.
Correlating the alerts with threat intelligence sources can help identify if the IP addresses are associated with known malicious activity, providing context to the alert data.
- B. Incorrect.
Blocking all IP addresses without further analysis may cause unintended disruptions, especially if some of the IPs are legitimate users. This step should not be the first priority.
- C. Correct.
Analyzing the server's authentication logs verifies the accuracy of the alert and provides additional details about the failed login attempts.
- D. Incorrect.
Ignoring the alerts is not a best practice, as it could allow a potential security breach to go unnoticed.
- E. Correct.
Checking for related alerts in the SIEM helps the analyst identify patterns, trends, or correlations that might indicate a broader attack.