200-201 Question 391
Single answerA cybersecurity analyst in your organization is using Protocol Statistics Information (PSI) to monitor network traffic. During their analysis, they notice an unusual spike in traffic on a specific protocol that is not typically used within the organization's environment. What is the most appropriate next step for the analyst?
- A
Investigate the source and destination of the unusual protocol traffic for potential malicious activity.
- B
Immediately block all traffic associated with the unusual protocol to prevent further activity.
- C
Ignore the unusual protocol traffic as it might just be a false positive.
- D
Reconfigure the network devices to stop collecting PSI for that protocol to reduce unnecessary logging.
Show answer and explanation
Correct answer: A
Explanation
Protocol Statistics Information (PSI) provides valuable insights into network traffic, including protocol usage patterns. Analyzing unusual spikes in protocol traffic is essential for detecting potential malicious activity. By investigating the source and destination of the traffic, the analyst can determine whether the activity is legitimate or indicative of a threat. Blocking or ignoring the traffic without proper investigation can lead to operational disruptions or missed security incidents.
- A. Correct.
Investigating the source and destination of the unusual protocol traffic is the correct course of action. Unusual traffic might indicate malicious activity, misconfigurations, or unauthorized use, so identifying its origin and intent is essential.
- B. Incorrect.
Blocking all traffic associated with the protocol without investigation can disrupt legitimate business operations if the traffic turns out to be authorized or necessary.
- C. Incorrect.
Ignoring the unusual protocol traffic is not a best practice in cybersecurity operations. Unusual activity should always be investigated to understand its nature.
- D. Incorrect.
Reconfiguring network devices to stop collecting PSI for the protocol is counterproductive, as it eliminates visibility into potentially malicious or unauthorized traffic.