200-201 Question 267
Select 2A cybersecurity analyst is monitoring network traffic and notices multiple alerts indicating communication attempts to a specific external IP address located in a high-risk country. The analyst decides to investigate the destination address further. Which of the following actions should the analyst prioritize to assess the potential threat posed by the destination address?
- A
Check the reputation of the destination IP address using threat intelligence platforms.
- B
Block the destination IP address immediately to prevent further communication.
- C
Analyze the traffic logs to identify the source of the communication within the organization.
- D
Perform a traceroute to the destination address to verify the network path.
- E
Contact the owner of the destination IP address for clarification.
Show answer and explanation
Correct answers: A, C
Explanation
When investigating a potentially malicious destination address, the analyst should first determine its reputation using threat intelligence tools and analyze internal traffic logs for context. These steps help prioritize the response and avoid unnecessary disruptions caused by premature actions such as blocking the address.
- A. Correct.
Checking the reputation of the destination IP address is a critical first step to determine whether it is associated with malicious activity. Threat intelligence platforms provide valuable insights into known malicious IPs.
- B. Incorrect.
Blocking the destination IP address immediately might disrupt legitimate traffic if the alert is a false positive. This action should only be taken after thorough investigation.
- C. Correct.
Analyzing traffic logs helps identify the internal source initiating communication with the destination address, providing context for the alert and enabling further investigation.
- D. Incorrect.
Performing a traceroute may provide information about the network path, but it is not a priority for assessing the threat level or reputation of the destination address.
- E. Incorrect.
Contacting the owner of the destination IP address is not typically practical or necessary in the initial stages of investigating a potential threat.