300-215 Question 201
Select 3During an incident response process, your team detects abnormal outbound traffic from a corporate system to an external IP address. You suspect this is a Command and Control (C2) communication. Using Cisco Secure Firewall and Secure Network Analytics, what should you do next to isolate the system while maintaining forensic integrity?
- A
Use Cisco Secure Firewall to block all outbound traffic from the suspected system.
- B
Leverage Cisco Secure Network Analytics to analyze historical traffic from the suspected system.
- C
Immediately shut down the suspected system to stop further data exfiltration.
- D
Use Cisco Secure Firewall to enforce a policy that allows only essential internal traffic for the suspected system.
- E
Quarantine the system on a separate VLAN using Cisco Secure Firewall features.
Show answer and explanation
Correct answers: B, D, E
Explanation
The correct steps in an incident response process involve isolating the suspected system to prevent further damage while preserving forensic evidence for investigation. Using Cisco Secure Firewall to enforce restrictive but operational policies and leveraging Cisco Secure Network Analytics for traffic analysis are essential actions. Shutting down the system prematurely or blocking all traffic can compromise evidence and investigation efforts.
- A. Incorrect.
Blocking all outbound traffic is a reactive measure that does not allow for continued monitoring or controlled isolation, which could hinder forensic investigation.
- B. Correct.
Analyzing historical traffic using Cisco Secure Network Analytics helps identify the scope of the incident and other potentially compromised systems.
- C. Incorrect.
Shutting down the system immediately could destroy volatile memory data, which is critical for forensic analysis.
- D. Correct.
Enforcing a policy to allow only essential internal traffic ensures the system remains operational for investigation while limiting the attacker's actions.
- E. Correct.
Quarantining the system on a separate VLAN isolates it effectively while maintaining forensic integrity and allowing controlled access for analysis.