200-201 Question 291
Select 3A Security Operations Center (SOC) analyst is investigating an incident where users are being redirected to malicious websites despite entering correct URLs in their browsers. Upon analysis, the analyst identifies unusual DNS query patterns from an internal host. Which of the following actions should the analyst take to mitigate the issue?
- A
Analyze the DNS logs and identify the source of the malicious queries.
- B
Flush the DNS cache on local devices and the DNS server.
- C
Block the identified malicious domain at the DNS level.
- D
Reconfigure the internal DNS server to forward queries to a public DNS resolver like 8.8.8.8.
- E
Perform a reverse lookup on the malicious domain to identify its IP address.
Show answer and explanation
Correct answers: A, B, C
Explanation
The correct actions focus on identifying the source of malicious DNS queries, removing cached malicious entries, and blocking further access to the malicious domain. These steps mitigate the immediate threat and address the root cause. Other actions, such as changing DNS server configurations or performing reverse lookups, do not directly mitigate the issue or may introduce additional risks.
- A. Correct.
Analyzing DNS logs helps identify the source of the malicious queries, which is critical for containing the threat and addressing the root cause.
- B. Correct.
Flushing the DNS cache removes any cached malicious entries, ensuring that future queries are resolved correctly.
- C. Correct.
Blocking the malicious domain at the DNS level prevents further redirections to the malicious website, mitigating the immediate threat.
- D. Incorrect.
Reconfiguring the internal DNS server to use a public DNS resolver is not a recommended action without proper evaluation, as it may bypass existing security controls and expose queries to external parties.
- E. Incorrect.
While performing a reverse lookup can aid in investigation, it does not directly mitigate the issue at hand and should not be prioritized over other critical actions.