200-201 Question 179
Select 3A security operations center (SOC) analyst is monitoring traffic in a network using a threat detection system that employs rules, signatures, and predictive AI. During the analysis, the system flags an unusual outbound connection to an unknown IP address. The flagged alert has a low confidence score. What should the analyst do to effectively validate the threat while leveraging the tools available?
- A
Cross-check the flagged IP address against threat intelligence feeds to identify its reputation.
- B
Ignore the alert since the confidence score is low and focus on higher priority alerts.
- C
Analyze the network behavior and traffic patterns using AI-driven anomaly detection tools.
- D
Modify the existing rule to lower the threshold for detecting similar behaviors in the future.
- E
Review the signature database to verify if the flagged behavior matches any known threats.
Show answer and explanation
Correct answers: A, C, E
Explanation
To validate the threat effectively, the SOC analyst should use a combination of approaches: checking threat intelligence feeds for IP reputation, leveraging AI-driven tools to analyze anomalies, and cross-referencing with the signature database. These steps ensure a thorough investigation of the flagged alert, even if it initially has a low confidence score, to avoid missing potential threats.
- A. Correct.
Cross-checking the flagged IP against threat intelligence feeds helps determine if the IP is associated with malicious activity, providing context for validation.
- B. Incorrect.
Ignoring the alert is a poor practice, as even low-confidence alerts may indicate real threats. Analysts should investigate further to confirm or dismiss the threat.
- C. Correct.
Analyzing network behavior with AI-driven tools can identify anomalies or patterns that might not be captured by static rules or signatures, aiding in threat validation.
- D. Incorrect.
Modifying the existing rule without proper validation may lead to unnecessary alerts or missed detections. This step requires careful analysis before implementation.
- E. Correct.
Reviewing the signature database can help determine if the flagged behavior matches known threats, allowing the analyst to correlate findings with established patterns.