200-201 Question 299
Select 2You are analyzing an alert generated by a Security Information and Event Management (SIEM) system. The event log includes the following elements:
- Source IP: 192.168.1.50
- Destination IP: 10.0.0.25
- Destination Port: 3389
- Protocol: TCP
- Alert Message: 'Suspicious Remote Desktop Protocol activity detected'
Which artifact element(s) should you prioritize to confirm whether this is a potentially malicious activity?
- A
Source IP: 192.168.1.50
- B
Destination IP: 10.0.0.25
- C
Destination Port: 3389
- D
Protocol: TCP
- E
Alert Message: 'Suspicious Remote Desktop Protocol activity detected'
Show answer and explanation
Correct answers: C, E
Explanation
To identify and confirm a potentially malicious activity, it is critical to focus on artifacts that provide actionable insights. The Destination Port (3389) indicates RDP traffic, which is a high-value target for attackers, while the Alert Message provides context that the SIEM system has flagged the activity as suspicious. These elements together help prioritize and guide the investigation.
- A. Incorrect.
The Source IP can provide insight into the origin of the traffic, but on its own, it does not confirm malicious activity unless further context is provided.
- B. Incorrect.
The Destination IP is useful for identifying the target system but does not directly indicate malicious behavior without other corroborating details.
- C. Correct.
The Destination Port (3389) is linked to Remote Desktop Protocol (RDP), which is frequently targeted in brute-force or unauthorized access attempts. This makes it a key artifact to investigate further.
- D. Incorrect.
The Protocol (TCP) is common for many types of traffic and does not inherently indicate malicious activity in this case.
- E. Correct.
The Alert Message ('Suspicious Remote Desktop Protocol activity detected') directly suggests a potential security event. It should be prioritized to understand the nature of the alert and guide further investigation.