200-201 Question 268
Single answerA cybersecurity analyst is monitoring network traffic and notices multiple outbound connections from an internal host to an external IP address that is not commonly accessed by the organization. The external IP address belongs to a server in a foreign country, known for hosting malicious activities. What action should the analyst take when considering the destination address in this scenario?
- A
Block the destination IP address immediately in the firewall and notify the network administrator.
- B
Ignore the outbound connections as they may be legitimate traffic.
- C
Perform a reverse DNS lookup to verify the legitimacy of the destination and escalate if suspicious.
- D
Capture more packets to analyze the content of the communication before taking any action.
Show answer and explanation
Correct answer: C
Explanation
When analyzing suspicious outbound connections, verifying the legitimacy of the destination address (e.g., through a reverse DNS lookup) is a critical step before taking further action. This approach ensures that any response is informed and avoids unnecessary disruption of potentially legitimate traffic.
- A. Incorrect.
Blocking the destination IP address immediately might disrupt legitimate business operations if the traffic is valid and needs to be verified first.
- B. Incorrect.
Ignoring the outbound connections could allow malicious activity to persist, especially if the destination address is suspicious.
- C. Correct.
Performing a reverse DNS lookup helps verify the legitimacy of the destination address, and escalating if suspicious ensures the issue is handled appropriately.
- D. Incorrect.
While analyzing the communication content may provide additional information, an initial investigation of the destination address should take priority to confirm its legitimacy.