Examkin

Question

Difficulty: HardNetwork Security Monitoring and Alerting

A network security analyst receives a high-severity Network Intrusion Detection System (NIDS) alert signaling anomalous outbound data transfers from a internal web server to an unknown external IP address. Which of the following sequences represents the correct chronological order of network security monitoring and incident triage steps the analyst should follow from initial alert validation through enterprise protection?

  1. 1Correlate the NIDS alert with web server access logs and SIEM event streams to confirm a true positive condition.
  2. 2Capture live network flow telemetry and analyze packet payloads to determine the scope of exfiltrated data.
  3. 3Apply targeted network access control rules to isolate the compromised web server from external endpoints.
  4. 4Extract network Indicators of Compromise (IoCs) and deploy updated NIPS signatures across the enterprise perimeter.

Answer

The correct sequence for network security monitoring and triage is: 1) Correlate the NIDS alert with web server access logs and SIEM event streams to confirm a true positive condition; 2) Capture live network flow telemetry and analyze packet payloads to determine the scope of exfiltrated data; 3) Apply targeted network access control rules to isolate the compromised web server from external endpoints; 4) Extract network Indicators of Compromise (IoCs) and deploy updated NIPS signatures across the enterprise perimeter.
The standard network security monitoring triage workflow starts with alert validation against correlated SIEM and web logs to confirm a true positive. Following validation, packet payload and NetFlow telemetry are analyzed to establish the breach extent and extract threat characteristics. Once the attack profile is understood, network isolation controls are applied to block live exfiltration. Finally, derived network Indicators of Compromise (IoCs) are deployed to NIPS rules to prevent secondary attacks enterprise-wide.

Step-by-Step Solution

1
Verify Alert Authenticity
Confirmed true positive alert identifying the source web server and destination IP.
Initial network monitoring triage requires cross-referencing raw NIDS alerts with host logs and SIEM data to rule out false positives.
2
Analyze Telemetry & Packet Data
Determined exfiltrated data volume, protocols, and malicious payload characteristics.
Inspecting packet payloads and flow records provides detailed context regarding breach impact and specific Indicators of Compromise (IoCs).
3
Enforce Network Isolation
Active exfiltration path blocked without powering off host, preserving volatile RAM and active connection state.
Network containment halts ongoing unauthorized transmission once the nature of the threat is understood.
4
Update Defensive Signatures
Enterprise NIPS and firewall devices configured with new block rules and signatures.
Feeding extracted IoCs back into network intrusion prevention systems mitigates risk across the rest of the enterprise.

Key Concept

Network Security Incident Monitoring and Alert Triage Workflow
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic