300-215 Question 146
Select 3During a security incident, an organization observes suspicious outbound traffic from multiple endpoints. The Cisco Secure Network Analytics (formerly Stealthwatch) identifies the traffic as part of a known Command and Control (C2) infrastructure. As a cybersecurity analyst, what response should you recommend based on the available intelligence artifacts?
- A
Isolate affected endpoints from the network to prevent further communication with the Command and Control infrastructure.
- B
Update the organization's firewalls to block the IP addresses and domains associated with the Command and Control servers.
- C
Inform end-users to avoid opening suspicious emails and attachments.
- D
Conduct a forensic analysis of the affected endpoints to determine the scope and impact of the compromise.
- E
Deactivate all user accounts in the organization to prevent further unauthorized access.
Show answer and explanation
Correct answers: A, B, D
Explanation
The correct response to this scenario involves immediate containment, mitigation, and investigation. Isolating affected endpoints and blocking malicious IPs/domains disrupts ongoing malicious activity, while forensic analysis provides critical insights into the attack's scope and impact. These actions align with best practices for incident response based on intelligence artifacts.
- A. Correct.
Isolating affected endpoints is a critical step to immediately contain the incident and prevent further communication with the malicious infrastructure.
- B. Correct.
Updating firewalls to block the identified Command and Control IPs and domains can disrupt ongoing malicious activities and prevent other devices from being compromised.
- C. Incorrect.
While user awareness is important, it is not directly relevant to blocking Command and Control traffic or responding to this specific incident.
- D. Correct.
Forensic analysis is essential to understand the full scope of the incident, assess data exfiltration, and identify potential vulnerabilities exploited during the attack.
- E. Incorrect.
Deactivating all user accounts is an overly drastic measure that is not proportional to the current situation. It would cause unnecessary disruption to the organization's operations.