350-201 Question 173
Select 4Your organization has detected unusual outbound traffic from multiple endpoints at odd hours, suggesting a potential data exfiltration attempt. As a cybersecurity analyst, which steps should you follow to investigate this case effectively?
- A
Identify and isolate the affected endpoints to prevent further data loss.
- B
Examine historical logs and traffic patterns for anomalies during the suspected timeframe.
- C
Immediately block all outbound traffic from the organization until the investigation is complete.
- D
Corroborate findings by checking for indicators of compromise (IoCs) in threat intelligence feeds.
- E
Notify external stakeholders immediately, including customers, before completing the investigation.
- F
Run forensic analysis on the endpoints to identify the root cause of the incident.
Show answer and explanation
Correct answers: A, B, D, F
Explanation
Effectively investigating a potential data exfiltration case requires a combination of containment, log analysis, threat validation, and forensic investigation, while avoiding unnecessary disruptions and premature communications. These steps ensure a well-informed and methodical approach to handling the incident.
- A. Correct.
Isolating affected endpoints is a critical step to contain the incident and prevent further data exfiltration.
- B. Correct.
Analyzing historical logs and traffic can help identify the scope of the incident and provide clues about the nature of the attack.
- C. Incorrect.
Blocking all outbound traffic is an extreme measure that can disrupt business operations and may not be necessary unless the situation is critical.
- D. Correct.
Checking threat intelligence feeds for related IoCs can help validate the findings and determine if the attack is part of a wider campaign.
- E. Incorrect.
Notifying external stakeholders prematurely, without a proper understanding of the incident, can lead to misinformation and unnecessary panic.
- F. Correct.
Forensic analysis on the endpoints provides deeper insights into the root cause and the attacker's methods, which is essential for remediation.