200-201 Question 207
Select 3During a cybersecurity investigation, an analyst discovers suspicious network traffic from an internal IP address communicating with a known malicious server. To establish corroborative evidence, which of the following actions would most help in confirming the suspicious activity?
- A
Review endpoint logs from the device at the internal IP address to check for unusual activity or malware execution.
- B
Analyze DNS logs to determine if the internal IP address resolved the domain of the malicious server.
- C
Generate a simulated phishing attack to see if the internal IP address falls victim to it.
- D
Correlate firewall logs to identify if other internal systems have communicated with the same malicious server.
- E
Examine email logs to see if the internal IP address was involved in any phishing email interactions.
Show answer and explanation
Correct answers: A, B, D
Explanation
Corroborative evidence involves gathering multiple sources of data to confirm or strengthen a hypothesis. In this scenario, reviewing endpoint logs, analyzing DNS logs, and correlating firewall logs can help confirm that the internal IP address is engaging in malicious activity. These actions provide different perspectives on the same event, which is critical to building a well-supported finding.
- A. Correct.
Reviewing endpoint logs from the device can provide a direct view of activities such as malware execution or unauthorized access, helping confirm the suspicious behavior.
- B. Correct.
Analyzing DNS logs can reveal whether the internal IP address resolved the domain of the malicious server, which supports the hypothesis of malicious intent.
- C. Incorrect.
Generating a simulated phishing attack is unrelated to the current investigation and does not help in corroborating evidence about the suspicious network traffic.
- D. Correct.
Correlating firewall logs to identify if other internal systems are communicating with the same malicious server can provide additional context and evidence of a broader attack.
- E. Incorrect.
Examining email logs is less relevant in this scenario unless there is a specific indication that phishing emails are linked to the suspicious network traffic.