200-201 Question 213
Select 4A cybersecurity analyst is monitoring the organization's Security Information and Event Management (SIEM) system. They notice a sudden spike in outbound traffic to an unfamiliar IP address during non-business hours. Which of the following actions would most appropriately identify this activity as an event?
- A
Check if the IP address belongs to a known external partner or service
- B
Correlate the traffic with previously observed activity patterns
- C
Immediately block all traffic to and from the IP address
- D
Evaluate whether the volume of traffic is anomalous for the organization
- E
Determine if the IP address is flagged in threat intelligence feeds
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Identifying an event requires analyzing observed activity to determine if it deviates from normal patterns or poses a potential security risk. Steps such as verifying the IP address, correlating with past behavior, and checking against threat intelligence help contextualize the activity. Simply blocking traffic is a response action and does not contribute to identifying the event.
- A. Correct.
Checking if the IP address belongs to a known partner or service is a valid step in identifying whether the activity is legitimate or suspicious.
- B. Correct.
Correlating the traffic with previously observed patterns helps determine if the activity aligns with normal behavior or indicates a deviation.
- C. Incorrect.
Blocking traffic immediately, without initial investigation, is a response action rather than a step to identify an event. This can disrupt legitimate operations.
- D. Correct.
Evaluating whether the traffic volume is anomalous helps in determining if the activity deviates from the organization's baseline and could indicate an event.
- E. Correct.
Determining if the IP address is flagged in threat intelligence feeds provides context on whether the destination is associated with malicious behavior.