200-201 Question 92
Select 3An organization's SOC team notices an unusual spike in outbound network traffic from a critical server during non-business hours. After reviewing the logs, they suspect potential data exfiltration. Which of the following tools or techniques would be most effective for confirming and further analyzing this security event?
- A
NetFlow analysis
- B
Endpoint detection and response (EDR) tools
- C
Web application firewall (WAF) logs
- D
SIEM correlation rules
- E
DNS sinkholing
Show answer and explanation
Correct answers: A, B, D
Explanation
To confirm and analyze potential data exfiltration, tools that provide insight into network traffic patterns (NetFlow), endpoint activity (EDR), and aggregated log correlation (SIEM) are highly effective. These tools complement each other by offering visibility at different levels: network, endpoint, and across the organization. While WAF logs and DNS sinkholing have their specific purposes, they are less relevant in this specific scenario.
- A. Correct.
NetFlow analysis provides visibility into network traffic patterns and can help identify unusual data flows, such as large outbound transfers, which are indicative of data exfiltration.
- B. Correct.
Endpoint detection and response (EDR) tools can help investigate suspicious activity on the server itself, such as processes or files involved in the data exfiltration.
- C. Incorrect.
Web application firewall (WAF) logs are primarily used for monitoring and protecting against web-based attacks, which may not directly help in identifying data exfiltration from a server unless it involves a web-facing application.
- D. Correct.
SIEM correlation rules can aggregate and correlate data from multiple sources, providing insights into anomalous behavior and helping to identify potential data exfiltration incidents.
- E. Incorrect.
DNS sinkholing is typically used to block malicious domains and prevent communication with known malicious actors, but it is not directly effective in analyzing or confirming data exfiltration events.