200-201 Question 225
Select 3You are a cybersecurity analyst monitoring network traffic in the Security Operations Center (SOC). You notice multiple inbound connections to an internal server from an unfamiliar external IP address. The internal server is not typically accessed from outside the organization. Further analysis shows a sudden spike in traffic volume to the server with unusual protocols. Based on your investigation, which of the following actions should you take to address the situation?
- A
Isolate the internal server from the network to prevent further unauthorized access.
- B
Block the external IP address at the firewall immediately.
- C
Capture and analyze the associated network traffic for further investigation.
- D
Ignore the activity since the traffic spike could be normal and temporary.
- E
Update the server's operating system and application software to the latest version.
Show answer and explanation
Correct answers: A, B, C
Explanation
When analyzing network intrusions, it is crucial to take immediate actions to contain the threat, prevent further unauthorized access, and gather evidence for investigation. Isolating the compromised asset, blocking malicious traffic, and analyzing network data are all essential steps. Ignoring the issue or delaying action could lead to further compromise, while updating software is a preventive measure rather than an immediate response.
- A. Correct.
Isolating the affected server is a critical step to prevent further potential compromise while the issue is being investigated.
- B. Correct.
Blocking the external IP address at the firewall can help stop the malicious activity and protect the internal server from unauthorized access.
- C. Correct.
Capturing and analyzing the traffic provides valuable data for understanding the nature of the threat and helps in identifying potential vulnerabilities or attack vectors.
- D. Incorrect.
Ignoring the activity is not a recommended action because the traffic spike and inbound connections are abnormal and could indicate malicious activity.
- E. Incorrect.
Updating the server is a good security practice, but it is not an immediate action that addresses the current network intrusion.