300-215 Question 137
Select 2A cybersecurity analyst is investigating multiple alerts from a Cisco Secure Network Analytics system, showing unusual outbound traffic from a critical server to an unknown IP address. Further analysis reveals that the server is communicating with a known Command and Control (C2) server. What mitigation techniques should the analyst recommend to immediately contain the threat and prevent further damage?
- A
Isolate the server by applying an access control rule on the firewall to block outbound traffic to the suspicious IP address.
- B
Perform a forensic image of the server before taking any containment actions to preserve evidence.
- C
Leverage Cisco SecureX orchestration capabilities to automate blocking of the C2 server across the environment.
- D
Disable all user accounts associated with the server to prevent unauthorized access.
- E
Reboot the server to terminate all active connections and processes associated with the threat.
Show answer and explanation
Correct answers: A, C
Explanation
When responding to a cyber incident involving communication with a C2 server, the primary goal is to contain the threat and prevent further damage. Blocking outbound traffic to the malicious IP ensures immediate containment, while leveraging automation through Cisco SecureX provides a faster and consistent response across the network. Forensic evidence can be preserved after containing the threat, but it should not delay containment actions.
- A. Correct.
Correct. Blocking outbound traffic to the suspicious IP address immediately contains the threat and prevents further communication with the C2 server. This is a crucial step in incident response.
- B. Incorrect.
Incorrect. While preserving evidence is important, immediate containment actions take precedence in this scenario to prevent further damage. Forensic imaging can follow containment.
- C. Correct.
Correct. Automating the blocking of the C2 server across the environment using Cisco SecureX ensures a rapid and consistent response, reducing the risk of further compromise.
- D. Incorrect.
Incorrect. Disabling user accounts is not relevant in this scenario since the server itself is compromised, not specific user accounts.
- E. Incorrect.
Incorrect. Rebooting the server could disrupt evidence collection and may not effectively terminate the threat, as the malicious processes may restart upon reboot.