200-201 Question 350
Single answerYou are a cybersecurity analyst monitoring network traffic in your organization. During your analysis, you notice an unusual spike in outbound DNS requests from a single workstation. Further investigation reveals that the workstation is attempting to communicate with a known malicious domain associated with a botnet. What is the most appropriate next step in your detection and analysis process?
- A
Isolate the affected workstation from the network to prevent further communication with the malicious domain.
- B
Ignore the event as it may be a false positive and continue monitoring the network traffic.
- C
Immediately shut down the DNS server to block all outbound DNS requests.
- D
Report the incident to the legal team without taking any immediate action.
Show answer and explanation
Correct answer: A
Explanation
When detecting and analyzing an incident involving suspicious outbound DNS traffic to a malicious domain, the priority is to contain the threat. Isolating the affected workstation ensures that communication with the malicious domain is blocked while allowing further investigation. Ignoring the event or taking overly disruptive actions, like shutting down the DNS server, can lead to greater risk or operational issues.
- A. Correct.
This is the correct action, as isolating the affected workstation prevents further damage and allows for deeper investigation without risking additional communication with the malicious domain.
- B. Incorrect.
Ignoring the event could allow the malicious activity to continue and potentially spread further within the network, compromising more systems.
- C. Incorrect.
Shutting down the DNS server is an overly disruptive action that would impact the entire organization's normal operations, making it an unsuitable response.
- D. Incorrect.
While reporting the incident to the legal team may be part of a later step, immediate action is required to contain the threat and mitigate further damage.