300-215 Question 123
Select 3You are investigating a suspected data exfiltration incident involving an internal host. Which combination of data sources would be most relevant to correlate for host-based and network-based activities to confirm the incident?
- A
NetFlow data to analyze network traffic patterns
- B
Endpoint logs from the suspected host to check for unauthorized file access
- C
DNS logs to identify suspicious domain lookups
- D
Firewall logs to detect blocked outbound connections
- E
Email server logs to identify phishing attempts targeting the user
Show answer and explanation
Correct answers: A, B, C
Explanation
To confirm a data exfiltration incident, it is critical to correlate both host-based and network-based data sources. NetFlow data helps identify unusual network traffic patterns, while endpoint logs provide insights into unauthorized host activities. DNS logs can reveal connections to suspicious domains involved in the exfiltration. These combined data sources provide a comprehensive view of the incident. Firewall logs and email server logs, while useful in other scenarios, are less relevant for this specific investigation.
- A. Correct.
NetFlow data provides valuable insights into network traffic patterns, such as whether large volumes of data were transferred to an external IP address, which is crucial for network-based analysis.
- B. Correct.
Endpoint logs from the host can reveal host-based activities, such as unauthorized file access, which could indicate the source of the exfiltration.
- C. Correct.
DNS logs can help identify suspicious domain lookups, such as connections to malicious or unauthorized external domains, which might be used for exfiltration.
- D. Incorrect.
While firewall logs can provide useful information about blocked connections, they are less relevant in this case, as the focus is on successful data exfiltration rather than blocked attempts.
- E. Incorrect.
Email server logs are useful for identifying phishing attacks, but they are not directly relevant to confirming data exfiltration in this scenario.