300-215 Question 93
Single answerWhile monitoring network traffic using Cisco Secure Network Analytics (formerly Stealthwatch), you notice an unusual spike in outbound traffic from a specific host. Upon further inspection, this traffic is directed to an unfamiliar external IP address using uncommon ports. What should be your next step to effectively analyze this anomaly?
- A
Verify if the external IP address belongs to a known trusted service by consulting threat intelligence feeds.
- B
Immediately block all traffic from the identified host to prevent further data exfiltration.
- C
Capture the full packet data for the identified traffic using Cisco Secure Network Analytics for deeper inspection.
- D
Ignore the anomaly as it could be related to legitimate business traffic.
Show answer and explanation
Correct answer: A
Explanation
Network traffic anomalies, such as unusual spikes in outbound traffic to unknown destinations, often indicate potential malicious activity. The first step in addressing such anomalies is to check the destination IP against threat intelligence feeds to identify whether it is associated with known threats or legitimate services. This approach ensures that subsequent actions, such as blocking traffic or capturing packet data, are based on accurate and contextual information.
- A. Correct.
This is the correct step since consulting threat intelligence feeds can help determine if the destination IP is malicious or part of a legitimate service, allowing for informed decision-making before further action.
- B. Incorrect.
Blocking traffic immediately without further analysis could disrupt legitimate business processes, especially if the anomaly turns out to be a false positive.
- C. Incorrect.
While capturing full packet data may be useful, it is not the first step in the analysis process. Verification of the external IP address is a more systematic starting point.
- D. Incorrect.
Ignoring the anomaly is not a recommended approach in forensic analysis or incident response, as it could allow potential malicious activity to persist.