300-215 Question 120
Select 3During an investigation of a suspected ransomware attack, you need to correlate data from host-based and network-based activities. Which of the following data sources would be most relevant to identify the initial point of compromise and the spread of the attack?
- A
Host-based endpoint logs such as Windows Event Logs or Sysmon data
- B
NetFlow data from network devices
- C
DNS query logs from internal DNS servers
- D
Threat intelligence feeds from external sources
- E
Firewall rule configuration files
Show answer and explanation
Correct answers: A, B, C
Explanation
To effectively investigate the ransomware attack, relevant data sources must be selected based on the type of incident. Host-based logs, such as Sysmon or Windows Event Logs, help identify the actions on compromised systems. NetFlow data provides visibility into network activity, enabling the analysis of lateral movement or data exfiltration. DNS logs can uncover suspicious domain lookups associated with command-and-control servers. While threat intelligence feeds and firewall configurations are valuable in a broader security context, they are not directly relevant for correlating host and network activity in this specific scenario.
- A. Correct.
Host-based endpoint logs, such as Windows Event Logs or Sysmon data, provide critical insights into processes, login events, and file access on the compromised host, helping to identify the initial point of compromise.
- B. Correct.
NetFlow data provides visibility into network traffic patterns, including unusual connections or data transfers, which can help trace the spread of the attack across the network.
- C. Correct.
DNS query logs can reveal malicious domain lookups or unusual DNS activity, which are common indicators of command-and-control communication during ransomware attacks.
- D. Incorrect.
Threat intelligence feeds are useful for identifying known threats but do not provide direct evidence of host or network activity specific to the incident under investigation.
- E. Incorrect.
Firewall rule configuration files do not provide information on active or historical traffic flows related to the incident and are therefore not directly useful for correlating data in this context.