200-201 Question 349
Select 4A security analyst is monitoring network traffic and notices a significant increase in outbound traffic to an unfamiliar IP address. After further analysis, they discover that the outbound traffic consists of encrypted data packets. Which of the following actions should the analyst take to detect and analyze the potential threat?
- A
Perform a reverse DNS lookup to identify the domain associated with the IP address.
- B
Capture and inspect the packets using a network traffic analysis tool to identify anomalies.
- C
Immediately blacklist the IP address to block further communication.
- D
Check the organization's threat intelligence feeds for any known information about the IP address.
- E
Search for unusual patterns or behaviors in endpoint logs that match the timeframe of the outbound traffic.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To effectively detect and analyze the potential threat, the security analyst should gather as much information as possible about the suspicious IP address and associated traffic. This includes performing a reverse DNS lookup, using network traffic analysis tools, consulting threat intelligence feeds, and investigating endpoint logs for unusual activity. Blacklisting the IP address is an action step, not an analysis or detection method, and therefore does not directly address the question's focus.
- A. Correct.
Performing a reverse DNS lookup can help identify the domain associated with the IP address, which may provide additional context for further investigation.
- B. Correct.
Using a network traffic analysis tool allows the analyst to examine the content and patterns of the packets, which is crucial for identifying potential threats.
- C. Incorrect.
While blacklisting the IP address might stop the data exfiltration, it is not a detection or analysis step, which is the focus of the question.
- D. Correct.
Threat intelligence feeds can provide valuable information about whether the IP address is associated with malicious activity, aiding in detection.
- E. Correct.
Endpoint logs often contain critical information about processes or users involved in the communication, which can help in identifying the root cause of the traffic.