300-215 Question 124
Select 4A security analyst is investigating a suspected malware infection on an organization’s network. Upon reviewing initial findings, the analyst identifies suspicious traffic originating from a specific host and notices unauthorized file transfers to an external IP address. Which types of data should the analyst prioritize correlating to determine the scope of the incident?
- A
Network traffic logs, such as NetFlow or packet captures, to identify communication patterns
- B
File integrity monitoring logs to detect changes to critical system files
- C
Authentication logs to verify user access patterns during the incident timeframe
- D
DNS query logs to identify potential connections to malicious domains
- E
Email metadata to assess potential phishing activity targeting the host
Show answer and explanation
Correct answers: A, B, C, D
Explanation
In this scenario, the analyst is dealing with a network-based malware infection involving unauthorized file transfers. Correlating network traffic logs, file integrity monitoring logs, authentication logs, and DNS query logs provides comprehensive insight into the malware’s behavior, its impact on the host, and its communication with external entities. Email metadata is less relevant here as no indications of phishing are mentioned in the incident description.
- A. Correct.
Network traffic logs are essential for identifying the communication patterns of the infected host, including external connections and data transfers.
- B. Correct.
File integrity monitoring logs help in identifying unauthorized changes to critical system files, which may indicate malware activity.
- C. Correct.
Authentication logs allow the analyst to determine if unauthorized user access occurred during the incident, which can provide context for the scope of the compromise.
- D. Correct.
DNS query logs can help identify whether the host communicated with known malicious domains, indicating potential command-and-control activity.
- E. Incorrect.
Email metadata may be useful for phishing investigations, but it is not directly relevant to correlating data for this network-based malware infection scenario.