200-201 Question 385
Select 3An incident response team has detected unusual traffic patterns from a web application server in their network. The traffic involves data being sent to an unknown external IP address using non-standard ports. Which of the following steps should the team take to investigate this suspicious behavior further?
- A
Review application logs for unusual activity during the period of suspicious traffic.
- B
Conduct a vulnerability scan of the web application server to identify possible weaknesses.
- C
Immediately shut down the web application server to stop the suspicious traffic.
- D
Analyze network traffic and packet captures to determine the nature of the communication.
- E
Ignore the traffic and monitor for further unusual activity over the next 24 hours.
Show answer and explanation
Correct answers: A, B, D
Explanation
To thoroughly investigate suspicious activity involving applications, it is crucial to gather as much information as possible. Reviewing application logs can provide details on any unusual actions or access attempts. Vulnerability scans can reveal weaknesses that might have been exploited. Analyzing network traffic helps determine the nature and intent of the communication, which is critical for assessing the potential threat. Immediate shutdowns may disrupt operations unnecessarily, and ignoring suspicious activity without investigation is not an acceptable cybersecurity practice.
- A. Correct.
Reviewing application logs can help identify anomalies in user behavior, unauthorized access, or unusual resource usage, which may correlate with the suspicious traffic.
- B. Correct.
Conducting a vulnerability scan can help uncover potential security weaknesses or misconfigurations in the application that could have been exploited.
- C. Incorrect.
Shutting down the server immediately may disrupt legitimate operations and hinder further investigation, making this choice inappropriate unless it’s a confirmed critical threat.
- D. Correct.
Analyzing network traffic and packet captures provides critical insights into the type, source, and destination of the suspicious communication, helping determine whether it is malicious.
- E. Incorrect.
Ignoring the traffic without immediate investigation is not a recommended practice in cybersecurity, as it may allow malicious activity to persist or escalate.