Examkin

Question

Difficulty: Very hardNetwork Security Monitoring and Alerting

A network security team receives a high-severity alert indicating anomalous telemetry from a critical database bridge host. An analyst inspects the correlated Network Flow (NetFlow) logs and DNS query events shown below:

Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.200.4.15:51204 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:07:11Z | SrcIP: 10.200.4.15:51210 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
Timestamp: 2026-07-27T14:12:10Z | SrcIP: 10.200.4.15:51216 -> DstIP: 198.51.100.77:443 | Proto: TCP | Bytes: 142 | State: ESTABLISHED
DNS Lookup Query: z9x4k1.ec2-updates-sync.net -> Resolved: 198.51.100.77 (TTL: 30s)

The analyst notes that low-volume outbound encrypted connections occur at fixed 300-second intervals following short-TTL DNS queries for algorithmically generated subdomains. Which of the following mitigation actions should the security analyst perform FIRST to contain the threat while minimizing operational disruption to legitimate encrypted web services?

  1. Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.Answer
  2. B
    Create an emergency perimeter firewall rule blocking all outbound traffic on destination TCP port 443 across the database bridge subnet.
  3. C
    Reclassify the alert as a false positive due to the standard port usage and small payload sizes typical of keep-alive signals.
  4. D
    Deploy an inline honeypot on port 443 within the database bridge subnet to automatically drop and inspect the outgoing packets.

Answer

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.
The observed telemetry displays classic indicators of compromised host C2 beaconing: regular timing intervals (300 seconds), uniform low byte size (142 bytes), and dynamic DNS lookups with low TTLs. Employing DNS sinkholing (RPZ) combined with proxy-level SNI filtering precisely disrupts the malicious C2 channel without taking down legitimate outbound HTTPS access on port 443.

Step-by-Step Solution

1
Analyze flow and log telemetry indicators
Identified periodic outbound HTTPS connections (every 300 seconds) with fixed 142-byte payloads to an external IP resolved via short-TTL dynamic DNS, confirming malware C2 beaconing.
Recognizing command and control beaconing behavior isolates the precise threat mechanism.
2
Evaluate candidate mitigation controls for precision and operational impact
Determined that DNS sinkholing via RPZ combined with SNI proxy filtering specifically isolates and redirects malicious communications without impacting unrelated business HTTPS traffic.
Effective security controls must mitigate targeted threats while preserving availability for legitimate services.
3
Select the optimal initial containment step
Selected domain-specific sinkholing and SNI-based egress filtering as the preferred first-line containment strategy.
This approach disrupts C2 reachability immediately with minimal risk of broad service outage.

Key Concept

Network Security Monitoring Alert Analysis and Command & Control (C2) Beacon Containment
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic