350-201 Question 46
Single answerYou are a cybersecurity analyst tasked with investigating a potential data exfiltration incident in your organization. Using Cisco Secure Network Analytics (Stealthwatch), you notice unusual outbound traffic from an internal server to an unfamiliar external IP address. Which technique should you prioritize to confirm whether this traffic is malicious?
- A
Enable flow-based telemetry to analyze the traffic patterns and associated metadata.
- B
Isolate the internal server immediately to prevent further data exfiltration.
- C
Use Cisco Talos Threat Intelligence to identify if the external IP address is associated with known malicious activity.
- D
Perform a full packet capture of the traffic for detailed payload analysis.
Show answer and explanation
Correct answer: C
Explanation
Using Cisco Talos Threat Intelligence to identify if the external IP is associated with known malicious activity is the most efficient and accurate technique in this scenario. It allows you to quickly determine whether the traffic is suspicious based on a reliable threat intelligence database, enabling a faster response. Other options, while useful in specific contexts, are either less efficient or more suitable for later stages of investigation and response.
- A. Incorrect.
Flow-based telemetry provides high-level metadata about traffic patterns but lacks the context needed to confirm if the external IP is associated with malicious activity. It is more suitable for initial detection rather than confirmation.
- B. Incorrect.
Isolating the internal server may disrupt legitimate business operations and should only be done after confirming malicious intent. This step is more appropriate as a containment measure rather than a detection technique.
- C. Correct.
Cisco Talos Threat Intelligence is a robust repository of known malicious indicators like IP addresses, domains, and file hashes. Checking the external IP against this database can quickly confirm if the traffic is likely malicious, making it highly effective for this scenario.
- D. Incorrect.
Full packet capture can provide detailed payload analysis, but it is resource-intensive and time-consuming. It is typically used after confirming a threat to analyze its nature, not as a primary detection technique.