300-215 Question 148
Single answerDuring a forensic investigation, you identify a suspicious file being downloaded multiple times from an external IP address. The downloaded file matches a known malware hash found in threat intelligence reports. Which response action should you recommend based on the provided intelligence artifact?
- A
Block the external IP address at the firewall and isolate affected hosts in the network.
- B
Delete the suspicious file from all affected hosts without further analysis.
- C
Report the external IP address to law enforcement while continuing to monitor the network.
- D
Increase logging levels for the affected hosts and wait for additional indicators of compromise.
Show answer and explanation
Correct answer: A
Explanation
The intelligence artifact (malware hash) confirms the malicious nature of the file. Blocking the external IP address and isolating affected hosts are immediate response actions that mitigate the threat and prevent further compromise. These actions align with best practices for incident response and containment based on intelligence artifacts.
- A. Correct.
Blocking the external IP address at the firewall prevents further downloads of the malicious file, and isolating affected hosts helps contain the threat and limit potential spread.
- B. Incorrect.
Deleting the file without further analysis may erase critical forensic evidence and does not address the root cause of the malicious activity.
- C. Incorrect.
Reporting the external IP address to law enforcement is a long-term action but does not immediately mitigate the threat or contain the attack.
- D. Incorrect.
Increasing logging levels and waiting for more indicators of compromise delays containment and allows the threat to persist and potentially cause more damage.