200-201 Question 93
Single answerA security analyst is monitoring an organization's network and notices a sudden spike in outbound traffic to an unfamiliar IP address. Which security monitoring technique would be most appropriate to further investigate and mitigate this potential threat?
- A
Conduct a packet capture to analyze the traffic contents
- B
Perform a vulnerability scan on the unfamiliar IP address
- C
Update the firewall rules to block the unfamiliar IP address
- D
Check for recent updates or patches applied to the servers
Show answer and explanation
Correct answer: A
Explanation
When a sudden spike in outbound traffic to an unfamiliar IP address is detected, conducting a packet capture allows the security analyst to inspect the traffic contents. This monitoring technique provides detailed visibility into the data being transmitted, enabling the analyst to identify potential threats, such as data exfiltration or malware communication. It is essential to analyze the data before taking any mitigation steps, such as blocking the IP or modifying firewall rules.
- A. Correct.
Packet capture is a critical security monitoring technique that allows an analyst to examine the contents of the traffic, helping identify whether it contains malicious data or unauthorized activity.
- B. Incorrect.
Performing a vulnerability scan on the unfamiliar IP address is not directly related to security monitoring in this scenario, as the focus is on investigating the outbound traffic, not the remote IP address itself.
- C. Incorrect.
Updating firewall rules prematurely without understanding the context of the traffic could disrupt legitimate activity and is not a monitoring technique.
- D. Incorrect.
Checking for recent updates or patches on servers is unrelated to monitoring the outbound traffic, as it focuses more on system maintenance and not real-time network investigation.