200-201 Question 300
Select 2A cybersecurity analyst at your organization receives an alert from a SIEM tool indicating potentially malicious activity. Upon reviewing the event artifacts, the analyst notices the following elements:
- Source IP: 192.168.100.10
- Destination IP: 10.0.0.5
- Destination Port: 3389
- Protocol: TCP
- Event Time: 2023-10-10 15:34:00
- Action: Allowed
Which artifact(s) would most likely help the analyst identify this as a potential Remote Desktop Protocol (RDP) brute-force attack?
- A
Destination Port: 3389
- B
Source IP: 192.168.100.10
- C
Event Time: 2023-10-10 15:34:00
- D
Protocol: TCP
- E
Action: Allowed
Show answer and explanation
Correct answers: A, D
Explanation
To identify an RDP brute-force attack, the analyst should focus on artifacts that provide information about the type of traffic (e.g., Destination Port: 3389 and Protocol: TCP) and correlate them with other data. Port 3389 is specifically associated with RDP, and TCP is the protocol used for this service. These artifacts strongly suggest that the alert is related to RDP activity, possibly a brute-force attempt.
- A. Correct.
Destination Port: 3389 is the default port for RDP, which is often targeted in brute-force attacks. This artifact is highly relevant in identifying the type of traffic.
- B. Incorrect.
Source IP: 192.168.100.10 can help identify the origin of the traffic, but on its own, it does not confirm that the attack is related to RDP brute-forcing.
- C. Incorrect.
The Event Time: 2023-10-10 15:34:00 provides a timestamp for the activity, but it does not directly indicate if this is related to RDP brute-forcing.
- D. Correct.
Protocol: TCP is used by RDP, making this artifact relevant when analyzing the nature of the traffic.
- E. Incorrect.
Action: Allowed simply indicates that the traffic was permitted, but it does not help identify if the activity was related to an RDP brute-force attack.