Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A network security analyst receives a SIEM alert indicating suspicious encrypted outbound traffic from an internal host to an untrusted external IP address. Place the following incident triage and network monitoring response actions in the correct chronological order, from initial alert confirmation to threat containment.

  1. 1Examine high-level NetFlow summary records to confirm anomalous outbound session duration, timing, and bandwidth usage.
  2. 2Inspect egress proxy logs and TLS handshake metadata to analyze Server Name Indication (SNI) header fields and SSL/TLS certificate details.
  3. 3Cross-reference identified destination IP addresses and extracted domain names against threat intelligence indicators of compromise (IoCs).
  4. 4Implement perimeter firewall block rules for the destination IP address and isolate the affected internal host from the network segment.

Answer

The proper sequence for triage begins with broad NetFlow analysis to validate traffic volume, followed by inspecting detailed TLS session metadata, correlating extracted domain and IP indicators against threat intelligence, and finally executing host isolation and firewall containment.
The standard network security monitoring triage flow moves systematically from high-level flow anomaly verification to granular metadata extraction, intelligence correlation, and targeted active containment.

Step-by-Step Solution

1
Perform initial flow telemetry verification using NetFlow logs.
Confirms the existence of an anomalous connection and establishes baseline metric deviations (e.g., unusual port, long duration, high byte count).
Flow data provides rapid, low-overhead confirmation of network activity before performing deep inspection.
2
Analyze session-level proxy and TLS metadata.
Extracts contextual protocol artifacts such as SNI, TLS version, cipher suites, and destination domain names.
Granular session logs reveal specific protocol behaviors and identifying attributes embedded within the connection.
3
Correlate collected indicators with threat intelligence databases.
Determines whether the destination IP or domain is associated with known command-and-control (C2) infrastructure.
Threat intelligence matching provides context and verification regarding the intent and severity of the suspicious activity.
4
Apply containment and mitigation controls.
Blocks communication to the external address and prevents lateral movement by isolating the compromised internal device.
Remediation prevents data exfiltration and active C2 operations once threat maliciousness is confirmed.

Key Concept

Network Security Monitoring Triage Lifecycle
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic