300-215 Question 138
Select 2An organization's SIEM platform has generated an alert indicating potential data exfiltration from a critical server. Upon further investigation, you confirm that outbound traffic is being sent to an unauthorized IP address over an uncommon port. Which of the following mitigation techniques should you recommend to immediately contain the threat and prevent further data exfiltration?
- A
Block the unauthorized IP address at the perimeter firewall
- B
Enable packet capture on the affected server to analyze the outgoing traffic
- C
Quarantine the affected server at the network level to isolate it from the rest of the network
- D
Perform a full operating system reinstallation on the affected server
- E
Update the SIEM platform with a new detection rule for similar suspicious traffic patterns
Show answer and explanation
Correct answers: A, C
Explanation
To contain the threat of data exfiltration during an active cyber incident, immediate actions such as blocking unauthorized IP addresses and isolating the affected server are critical. These steps stop the ongoing malicious activity and prevent further damage. Other actions, such as forensic analysis or proactive rule updates, are important but secondary to immediate containment.
- A. Correct.
Blocking the unauthorized IP address at the firewall is an immediate step to stop data exfiltration to that specific destination. This action mitigates the immediate threat.
- B. Incorrect.
While enabling packet capture can provide valuable forensic data, it does not actively stop the ongoing data exfiltration, making it insufficient as a standalone mitigation technique.
- C. Correct.
Quarantining the affected server prevents further unauthorized access or data exfiltration by isolating it from the network. This is a crucial containment measure.
- D. Incorrect.
A full operating system reinstallation is a longer-term remediation step but is not appropriate for immediate containment during an active incident.
- E. Incorrect.
Updating the SIEM with a detection rule is a proactive measure for future alerts but does not help in containing the current incident.