Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst receives a high-severity intrusion detection alert indicating an unusual volume of outbound DNS queries containing randomized long subdomains. Arrange the following security operations steps in the correct chronological sequence from initial alert triage to network-wide remediation.

  1. 1Inspect packet captures and network security monitoring logs to analyze the structure of the anomalous DNS TXT record payloads.
  2. 2Cross-reference host endpoint detection logs to verify which process initiated the DNS queries and confirm a true positive incident.
  3. 3Place the affected host into network isolation to stop active data exfiltration while preserving memory state for forensic investigation.
  4. 4Configure perimeter firewalls and internal DNS sinkholes to block all outbound traffic destined for the identified malicious external domains.

Answer

The correct sequence begins with analyzing packet captures and NSM logs to inspect the DNS payloads (Step 1), followed by correlating endpoint logs to confirm a true positive (Step 2), isolating the affected system to halt exfiltration (Step 3), and finally implementing DNS sinkhole and firewall blocks across the enterprise (Step 4).
The correct workflow follows standard network security operations methodology: initial traffic analysis (inspecting packet captures to determine payload indicators), true positive validation (correlating host process activity), targeted host containment (isolating the endpoint to stop data exfiltration), and broader organizational mitigation (updating firewall blocks and DNS sinkholes).

Step-by-Step Solution

1
Analyze network security monitoring logs and PCAP files.
Identified anomalous DNS TXT payload structures and target domain names.
Triage begins at the network level to understand the scope and signature of the alert.
2
Correlate network data with endpoint activity logs.
Confirmed an unauthorized executable generating DNS queries on a specific host.
Validation prevents taking destructive containment measures based on false positives.
3
Isolate the compromised system from the network segment.
Active DNS tunneling exfiltration session terminated.
Host containment prevents further exfiltration while preserving forensic evidence.
4
Apply perimeter firewall blocks and update DNS sinkhole configurations.
Blocked command-and-control and exfiltration domains organization-wide.
Mitigation controls ensure no other host on the network can communicate with the attacker infrastructure.

Key Concept

Network Security Monitoring Alert Triage and Incident Containment Lifecycle
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic