300-215 Question 188
Select 4During a security investigation, you are tasked with analyzing network traffic for signs of a data exfiltration attack. Using NetFlow data, you observe a host within your network communicating with an external IP address over an unusual port for an extended period of time. Which of the following actions should you take to further investigate the suspicious activity using Wireshark and NetFlow data?
- A
Apply a display filter in Wireshark to isolate traffic associated with the unusual port and analyze packet contents.
- B
Use NetFlow to verify if the external IP address belongs to a known malicious server or domain.
- C
Inspect DNS traffic in Wireshark to determine if the domain associated with the external IP address was resolved by the internal host.
- D
Filter only TCP Reset packets in Wireshark to confirm if the external server is attempting to disrupt communication.
- E
Analyze NetFlow data to identify whether the internal host has communicated with other suspicious external IPs.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Data exfiltration often involves unusual communication patterns, such as extended connections to external IPs over non-standard ports. By using a combination of NetFlow data and Wireshark, investigators can analyze traffic patterns, resolve potential malicious domains, and inspect packet contents for indicators of compromise. Actions such as filtering traffic by port, inspecting DNS resolutions, and correlating NetFlow data are key to uncovering and confirming malicious activity.
- A. Correct.
This is a valid action. Applying a display filter in Wireshark to isolate traffic on the unusual port allows you to focus your analysis and examine the packet payloads for possible indicators of data exfiltration.
- B. Correct.
This is a valid action. NetFlow can provide insights into whether the external IP address is associated with known malicious actors, which is critical in confirming the suspicious nature of the activity.
- C. Correct.
This is a valid action. DNS inspection in Wireshark can reveal if the internal host resolved the external IP address via a suspicious or unauthorized domain, which could be part of the attack chain.
- D. Incorrect.
Filtering for TCP Reset packets is not directly relevant to investigating data exfiltration. While it may help in other contexts, it does not provide actionable information about the suspicious communication in this scenario.
- E. Correct.
This is a valid action. Analyzing NetFlow data for additional suspicious communications can help identify whether the internal host is part of a broader compromise or exfiltration campaign.