300-215 Question 115
Select 3You are investigating a potential security incident using Cisco Secure Network Analytics (formerly Stealthwatch) and notice an alert in the SIEM indicating a high volume of outbound traffic from a specific endpoint. The alert log from the IDS/IPS indicates this traffic is associated with potential data exfiltration behavior. What should you look for in the syslogs to validate this activity?
- A
Unusual outbound connection patterns or destinations in the syslogs
- B
Failed login attempts from the affected endpoint
- C
High CPU or memory usage logs from the endpoint
- D
Scheduled tasks or scripts executed during the timeframe of the alert
- E
Firewall logs showing blocked outbound traffic attempts from the endpoint
Show answer and explanation
Correct answers: A, D, E
Explanation
To validate potential data exfiltration behavior, it is critical to analyze logs that indicate unusual outbound activity, such as connection patterns, associated scripts or tasks, and blocked outbound traffic. These logs provide a more comprehensive view of the endpoint's behavior during the alert timeframe and help confirm whether the activity is part of an attack or a false positive.
- A. Correct.
Unusual outbound connection patterns or destinations in the syslogs can provide critical insights into suspicious behavior, such as unexpected destinations or protocols, which aligns with potential data exfiltration.
- B. Incorrect.
Failed login attempts could indicate a brute-force or credential-stuffing attack, but they are not directly related to validating the data exfiltration activity described in the scenario.
- C. Incorrect.
High CPU or memory usage could be indicative of malware or other performance issues but does not directly validate the outbound data exfiltration behavior.
- D. Correct.
Scheduled tasks or scripts executed during the timeframe of the alert can point to automated processes or malicious scripts used to exfiltrate data.
- E. Correct.
Firewall logs showing blocked outbound traffic attempts from the endpoint can confirm that the endpoint was actively attempting to send data outside the network, aligning with the potential data exfiltration behavior.