200-201 Question 338
Select 3A Security Operations Center (SOC) analyst is monitoring network traffic and notices unusual outbound connections to an IP address in a foreign country. The connections are consistent and occur during unusual hours, but there are no known legitimate business activities requiring communication with that IP. Which of the following steps should the analyst perform to detect and analyze this potential threat?
- A
Correlate the outbound connections to an internal user's activity using system logs.
- B
Block the IP address immediately without further investigation to ensure security.
- C
Perform a threat intelligence lookup to determine whether the IP address is associated with malicious activity.
- D
Contact the user associated with the outbound connections to determine if the activity is legitimate.
- E
Review historical network traffic patterns to identify if this behavior is a recurring anomaly.
Show answer and explanation
Correct answers: A, C, E
Explanation
Detection and analysis of unusual outbound connections require collecting relevant evidence, correlating user and system activity, and assessing the risk using threat intelligence. Immediate remediation such as blocking should be preceded by thorough investigation to differentiate between legitimate and malicious activity. Historical traffic analysis also aids in understanding the context and recurrence of the anomaly, strengthening the detection process.
- A. Correct.
Correlating the outbound connections to an internal user's activity using system logs is essential for identifying the source of the connections and understanding their context. This step helps in determining whether the traffic is legitimate or suspicious.
- B. Incorrect.
Blocking the IP address immediately without further investigation may prevent legitimate business operations. A thorough analysis is required before taking such drastic action.
- C. Correct.
Performing a threat intelligence lookup is a critical step to determine if the IP address is associated with known malicious actors. This helps in assessing the risk level of the activity.
- D. Incorrect.
While contacting the user may provide more context, it is not the first step in the detection and analysis process. The analyst should gather evidence and perform technical analysis before involving the user.
- E. Correct.
Reviewing historical network traffic patterns helps in identifying if this behavior is isolated or part of a larger trend. Patterns can provide additional insight into the nature of the anomaly.