300-215 Question 86
Select 4You are investigating a potential data exfiltration incident in a cloud-native application hosted on a Kubernetes environment. Using Cisco Secure Cloud Analytics (Stealthwatch Cloud), you analyze the application logs and identify unusual outbound traffic from a containerized microservice. Which log entries would most likely help confirm if this is a malicious exfiltration event?
- A
HTTP request logs showing large data uploads to an external IP address
- B
DNS query logs revealing frequent lookups for suspicious domain names
- C
Authentication logs indicating repeated failed login attempts to the Kubernetes API
- D
Container runtime logs showing the execution of a base64-encoded process
- E
Audit logs from the cloud provider detailing changes to firewall rules
- F
Network flow logs showing a sudden increase in outbound traffic volume
Show answer and explanation
Correct answers: A, B, D, F
Explanation
To confirm a data exfiltration incident in a cloud-native application, it is critical to leverage multiple log sources to identify suspicious behavior. HTTP request logs can reveal large data uploads, DNS logs can point to malicious domains, and container runtime logs may indicate obfuscation techniques like encoding commands. Additionally, network flow logs showing abnormal outbound traffic provide evidence of potential data exfiltration. Together, these logs provide a comprehensive view that can confirm malicious activity.
- A. Correct.
HTTP request logs showing large data uploads could indicate data exfiltration to an external source, which is suspicious in the context of this event.
- B. Correct.
DNS query logs with frequent lookups for suspicious domains may suggest communication with a command-and-control server often used in exfiltration scenarios.
- C. Incorrect.
Authentication logs showing failed login attempts to the Kubernetes API are more indicative of a brute-force attack, not necessarily related to data exfiltration.
- D. Correct.
Container runtime logs highlighting base64-encoded processes suggest potential obfuscation tactics, which are common in exfiltration or malicious activity.
- E. Incorrect.
Changes to firewall rules in cloud provider audit logs may indicate a misconfiguration but are not directly linked to confirming data exfiltration in this scenario.
- F. Correct.
Network flow logs showing a sudden increase in outbound traffic volume are a strong indicator of data exfiltration, especially when coupled with other suspicious behavior.