200-201 Question 281
Select 3A cybersecurity analyst at a Security Operations Center (SOC) is investigating a suspected malicious activity involving an IPv4 address. The analyst observes that the source IP address of the traffic is 192.168.15.34. After analyzing the network, the analyst suspects that the attacker may be spoofing the source address. Considering the characteristics of IPv4 addressing, which of the following actions should the analyst take to verify if the address can be trusted?
- A
Check if the IP address is part of a private IP range and confirm whether it belongs to the internal network.
- B
Perform a reverse DNS lookup to verify if the IP address resolves to a legitimate domain name.
- C
Verify the IP address against known threat intelligence feeds for malicious activity.
- D
Block all traffic from 192.168.15.34 immediately to prevent further attacks.
- E
Analyze the subnet mask to determine if the source IP address belongs to a different network.
Show answer and explanation
Correct answers: A, B, C
Explanation
To investigate suspected malicious activity involving an IPv4 address, it is important to evaluate its legitimacy by checking if it belongs to private address ranges, performing reverse DNS lookups, and verifying it against threat intelligence feeds. These actions can help confirm whether the source address is spoofed or associated with malicious activity. Blocking traffic prematurely or analyzing the subnet mask in isolation might lead to incomplete or incorrect conclusions.
- A. Correct.
Correct. The 192.168.15.34 IP address is within the private IPv4 address range. Verifying if it belongs to the internal network can help determine if the traffic is legitimate or spoofed.
- B. Correct.
Correct. A reverse DNS lookup can help confirm if the source IP address resolves to a legitimate domain, adding credibility to the connection.
- C. Correct.
Correct. Checking the IP address against known threat intelligence feeds can help identify if it is associated with malicious activity.
- D. Incorrect.
Incorrect. Blocking traffic without further investigation could lead to disruption of legitimate communications if the source address is genuine.
- E. Incorrect.
Incorrect. Analyzing the subnet mask alone does not provide enough information to confirm whether the source IP address is spoofed or malicious.