200-201 Question 337
Single answerA cybersecurity analyst is monitoring a network using a SIEM solution and detects unusual outbound traffic from an internal server. After further investigation, the analyst discovers that the server is communicating with an unknown external IP on an uncommon port. What should the analyst do next to analyze this potential threat?
- A
Perform a packet capture to analyze the content of the communication
- B
Immediately block all outbound traffic from the server
- C
Search for known Indicators of Compromise (IoCs) related to the external IP
- D
Reboot the server to stop the suspicious activity
Show answer and explanation
Correct answer: A
Explanation
The correct next step in detecting and analyzing a potential threat is to perform a packet capture. This provides detailed insight into the nature of the communication, helping the analyst determine whether the activity is malicious or benign. Other options either risk disrupting legitimate operations or fail to provide the necessary context for analysis.
- A. Correct.
Performing a packet capture allows the analyst to examine the content and context of the communication in detail, which is essential for understanding whether the traffic is malicious.
- B. Incorrect.
Blocking all outbound traffic immediately could disrupt legitimate business processes and should only be done after confirming malicious behavior.
- C. Incorrect.
Searching for known IoCs may help, but it should not be the first step. The analyst needs more context about the activity before correlating it with known threats.
- D. Incorrect.
Rebooting the server is not a recommended step for initial analysis as it could destroy evidence and hinder further investigation.