300-215 Question 91
Single answerDuring a routine network traffic analysis using Cisco Secure Network Analytics (formerly Stealthwatch), a security analyst notices a significant increase in outbound traffic from a single internal host to an unfamiliar external IP address over an uncommon port. Which action should the analyst prioritize to determine if this is an anomaly or a potential security threat?
- A
Verify the external IP address against a threat intelligence database.
- B
Immediately block all traffic from the internal host to the external IP address.
- C
Run a packet capture on the network to analyze the contents of the traffic.
- D
Review the internal host's historical traffic patterns and baseline behavior.
Show answer and explanation
Correct answer: D
Explanation
To determine if the observed increase in traffic is an anomaly, the analyst should first compare it against the host's historical traffic patterns and baseline behavior. This helps identify deviations from normal activity. While other actions, such as verifying the external IP or running a packet capture, may be useful later, they are not the most immediate or prioritized action for anomaly detection.
- A. Incorrect.
Verifying the external IP address against a threat intelligence database can help determine if it is known to be malicious, but it is not the first step to confirm whether this is an anomaly or normal behavior.
- B. Incorrect.
Blocking traffic immediately could disrupt legitimate business operations if the activity is not confirmed as malicious. This is a reactive approach without sufficient evidence.
- C. Incorrect.
Running a packet capture is a detailed analysis technique but is not the first step. It requires additional resources and may not immediately clarify if the behavior is anomalous.
- D. Correct.
Reviewing the internal host's historical traffic patterns and baseline behavior is the first step to determine if the observed increase in traffic is anomalous compared to its usual activity.