300-215 Question 149
Single answerDuring an incident investigation, your team discovered a suspicious domain communicating with a compromised internal host. After analyzing threat intelligence artifacts, you identify the domain is associated with a known malware campaign. What is the most appropriate response to mitigate the threat while ensuring minimal disruption to regular business operations?
- A
Block the domain at the firewall and monitor all ongoing traffic for anomalies.
- B
Disconnect the compromised host from the network and perform a full forensic analysis.
- C
Add the domain to the DNS sinkhole and monitor for additional host infections.
- D
Shut down all network traffic to prevent further communication with the malicious domain.
Show answer and explanation
Correct answer: C
Explanation
The most appropriate response is to add the domain to a DNS sinkhole. This approach effectively disrupts malicious communication while allowing the organization to monitor for other infected hosts. It strikes a balance between containment and minimizing operational impact, aligning with best practices for incident response.
- A. Incorrect.
Blocking the domain at the firewall may mitigate the immediate threat, but it does not provide visibility into potential other infected hosts. Additionally, blocking at the firewall may not cover all possible communication paths to the domain.
- B. Incorrect.
While disconnecting the compromised host is a good step for containment, it does not address the potential spread of the malware to other hosts in the network. A broader strategy is required.
- C. Correct.
Adding the domain to a DNS sinkhole ensures that any further communication attempts with the malicious domain are redirected. This approach allows you to monitor for additional infected hosts without disrupting legitimate network traffic.
- D. Incorrect.
Shutting down all network traffic is a drastic measure that would severely disrupt business operations and is unnecessary in this scenario. A more targeted response is preferred.