300-215 Question 129
Single answerYou are tasked with analyzing a recent breach in your organization's network. During your investigation using Cisco Secure Network Analytics (Stealthwatch), you discover unusual outbound traffic from a particular endpoint to multiple external IP addresses over uncommon ports. Upon further inspection, you identify that the endpoint has an unpatched web application running. What action should you recommend to mitigate the identified attack vector?
- A
Apply the latest security patches to the web application.
- B
Block all outbound traffic from the endpoint at the firewall.
- C
Disable external access to the web application immediately.
- D
Initiate a full network shutdown to prevent further data exfiltration.
Show answer and explanation
Correct answer: A
Explanation
The correct action is to apply the latest security patches to the web application, as the unpatched software is the attack vector being exploited. This approach directly mitigates the vulnerability while allowing legitimate operations to continue. Other options either focus on temporary mitigations or introduce unnecessary disruption to the organization.
- A. Correct.
Applying the latest security patches to the web application addresses the root cause of the vulnerability, preventing further exploitation of the unpatched software.
- B. Incorrect.
Blocking all outbound traffic from the endpoint may temporarily stop data exfiltration but does not address the root cause and could disrupt legitimate traffic.
- C. Incorrect.
Disabling external access to the web application might mitigate the attack but could disrupt business operations unnecessarily without addressing the underlying vulnerability.
- D. Incorrect.
Initiating a full network shutdown is an extreme response that could cause significant business disruption and is not warranted in this scenario.