Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst receives a high-priority alert indicating suspicious data transfers originating from an internal workstation. Arrange the network security monitoring and response actions in the correct sequential order from initial alert detection to detection rule optimization.

  1. 1Triage the initial alert notification generated by the perimeter Network Intrusion Detection System (NIDS).
  2. 2Cross-reference NetFlow data and firewall session logs to verify active connections and traffic volume.
  3. 3Perform deep packet inspection on captured PCAP files from network monitoring sensors to analyze payloads.
  4. 4Apply Network Access Control (NAC) isolation policies to restrict the compromised host's network communication.
  5. 5Update SIEM correlation rules and NIDS signature definitions using verified indicators of compromise (IoCs).

Answer

The correct sequential order begins with triaging the initial NIDS alert, followed by cross-referencing NetFlow and firewall logs, performing deep packet inspection on PCAPs, applying NAC network isolation policies, and finally updating SIEM correlation rules and NIDS signatures.
Effective network security monitoring follows a structured incident response sequence. Response starts at initial alert triage, proceeds through flow correlation to verify connection validity, conducts deep packet inspection for payload analysis, executes containment via Network Access Control to halt threat propagation, and finishes by refining detection rules in the SIEM and NIDS.

Step-by-Step Solution

1
Alert Triage
Identified suspicious alert metadata from the perimeter NIDS sensor.
The analyst must first examine the initial trigger to understand the target host and alert classification.
2
Telemetry Correlation
Confirmed active session duration and transfer volume via NetFlow and firewall log entries.
Before performing resource-intensive analysis, flow telemetry must confirm that actual traffic traversed the network.
3
Packet Payload Inspection
Extracted malicious command-and-control artifacts and payload signatures from PCAP data.
Inspecting raw frame contents provides concrete evidence of compromise needed to justify containment.
4
Host Containment
Isolated the originating workstation from the broader enterprise network using NAC.
Containing the network segment stops data exfiltration and lateral movement while preserving evidence.
5
Rule Optimization and Feedback
Tuned SIEM correlation rules and updated intrusion signatures with newly identified IoCs.
Post-incident detection rule adjustments improve future monitoring speed and reduce false positives.

Key Concept

Network Security Monitoring Incident Handling Workflow
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic