A security analyst investigating enterprise Network Security Monitoring (NSM) alerts receives a notification from a Network Traffic Analysis (NTA) sensor. The alert indicates an unusual volume of outbound encrypted SSH traffic on port 22 originating from an internal corporate workstation toward an unfamiliar external IP address during non-business hours. Which of the following actions should the analyst perform as initial investigation and containment steps? (Select TWO.)
- Cross-reference endpoint detection logs on the workstation to identify the local process and user context associated with the outbound SSH connections.Answer
- Temporarily isolate the workstation from the internal network to prevent potential unauthorized data exfiltration.Answer
- CReconfigure the NTA sensor to automatically deploy an interactive honeypot on the external destination network to capture attacker tactics.
- DDeploy a Web Application Firewall (WAF) rule to block incoming HTTP POST requests directed toward the workstation's web server.
Answer
The analyst should check endpoint detection logs to verify the initiating process and temporarily isolate the workstation from the network to prevent data exfiltration.
Verifying host endpoint logs establishes whether an unauthorized process created the SSH tunnel, while isolating the workstation from the network halts active data transfer without altering volatile system state.
Step-by-Step Solution
Key Concept
Network traffic anomaly triage and initial incident containment.