350-201 Question 112
Single answerYou are a security engineer tasked with monitoring and securing a company's network infrastructure. While reviewing Cisco Secure Network Analytics (Stealthwatch) flow data, you identify unusual traffic patterns originating from an internal server. The traffic includes large amounts of outbound data to an unknown IP address in a foreign country. Which action should you take to investigate and mitigate this potential threat?
- A
Block the server's outbound traffic using an Access Control List (ACL) without further investigation.
- B
Use Cisco Secure Network Analytics to investigate the flow details and identify the application or process responsible for the traffic.
- C
Shut down the server immediately to prevent data exfiltration.
- D
Deploy Cisco Umbrella to block further communication with the suspicious foreign IP address and monitor DNS activity.
Show answer and explanation
Correct answer: B
Explanation
The correct action is to investigate the unusual traffic using Cisco Secure Network Analytics. This tool provides visibility into the network flows and helps identify whether the activity is malicious or benign. Acting without proper investigation, such as blocking traffic or shutting down the server, can lead to unnecessary disruptions or incomplete remediation. Cisco Umbrella is useful for ongoing DNS-layer protection but is not the initial step for addressing this specific scenario.
- A. Incorrect.
Blocking traffic immediately using an ACL without further investigation could disrupt legitimate operations if this server is critical. Investigation is necessary to confirm it is a threat.
- B. Correct.
Using Cisco Secure Network Analytics to investigate flow details is the correct approach, as it allows you to analyze the traffic, identify the application or process involved, and determine whether the activity is malicious.
- C. Incorrect.
Shutting down the server immediately is a drastic measure and could result in significant operational disruptions if the server supports critical business functions. This should only be done as a last resort after confirming the activity is malicious.
- D. Incorrect.
Deploying Cisco Umbrella is a good measure for DNS-layer security, but it is not the immediate step for investigating and mitigating the issue. It can be part of a broader strategy after initial investigation.