300-215 Question 121
Select 3An organization detects unusual DNS requests originating from multiple endpoints within their network. As part of the forensic analysis process, you are tasked with determining the data to correlate in order to investigate the incident. Which of the following data sources would be most relevant for correlating host-based and network-based activities in this scenario?
- A
DNS query logs from internal DNS servers
- B
NetFlow records or network traffic flow data
- C
Endpoint process execution logs
- D
Web proxy logs detailing HTTP/HTTPS traffic
- E
Firewall configuration settings
Show answer and explanation
Correct answers: A, B, C
Explanation
To investigate unusual DNS requests, it is critical to correlate both host-based and network-based data. DNS query logs and NetFlow records provide network-level visibility into the activity, while endpoint process execution logs help identify the host-level origin of the requests. Together, these sources allow a comprehensive investigation. Web proxy logs and firewall configurations are less relevant in this specific context.
- A. Correct.
DNS query logs are essential as they provide visibility into the DNS requests made by the hosts, helping identify potentially malicious domains.
- B. Correct.
NetFlow records help analyze network traffic patterns, such as the volume and frequency of DNS requests, which can indicate anomalies in network activity.
- C. Correct.
Endpoint process execution logs provide insights into processes or applications that may have initiated the suspicious DNS requests, offering a host-based perspective for the investigation.
- D. Incorrect.
Web proxy logs are useful for analyzing HTTP/HTTPS traffic but are less relevant for DNS-related incidents unless the DNS activity is tied to specific web traffic.
- E. Incorrect.
Firewall configuration settings are not directly useful for correlating data in this scenario, as they typically define rules and policies rather than providing detailed logs of DNS or process activity.