200-201 Question 188
Select 3A Security Operations Center (SOC) analyst receives an alert indicating unusual outbound traffic from a corporate server. The analyst reviews the server logs and discovers that a series of large files were transferred to an unfamiliar external IP address using an encrypted protocol. Which of the following actions should the analyst prioritize to respond to this situation?
- A
Isolate the server from the network to prevent further data exfiltration.
- B
Contact the external IP address owner to request more information.
- C
Perform a forensic analysis on the server to identify the root cause of the incident.
- D
Update firewall rules to block traffic to the external IP address.
- E
Notify the organization's incident response team and escalate the event.
Show answer and explanation
Correct answers: A, C, E
Explanation
When responding to a potential data exfiltration event, the first priority is to contain the impact by isolating the compromised system. From there, forensic analysis is necessary to determine the root cause and scope of the incident. Finally, notifying the incident response team ensures the organization can manage the incident effectively and prevent further damage. Actions like blocking traffic to the external IP or contacting the IP owner may come later but are not as critical in the initial response phase.
- A. Correct.
Isolating the server is critical to prevent additional data exfiltration or further compromise by the attacker. This is typically one of the first steps in incident response.
- B. Incorrect.
Contacting the external IP address owner is not a priority during initial response. This action may be taken later as part of the investigation process.
- C. Correct.
Performing a forensic analysis helps to identify how the breach occurred, what data was accessed, and whether the attacker has left any backdoors. This is a crucial step in mitigating the incident effectively.
- D. Incorrect.
While updating firewall rules to block traffic to the external IP address is important, it is not an immediate priority compared to isolating the server and initiating investigation steps.
- E. Correct.
Notifying the incident response team ensures that the event is escalated appropriately and that the organization can begin coordinated mitigation and recovery efforts. This is a critical action in incident response.