Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A network security analyst receives a high-severity alert from a Network Traffic Analysis (NTA) system regarding anomalous outbound encrypted communications originating from an internal workstation. Place the following incident triage and response steps in the correct sequential order from initial alert verification to containment.

  1. 1Examine NetFlow data to confirm that the host traffic deviates significantly from established baseline volumes and duration.
  2. 2Inspect packet capture (PCAP) data to extract protocol metadata, TLS certificate signatures, and external destination IP addresses.
  3. 3Query threat intelligence databases using the extracted destination IP address and domain metrics to verify known malicious activity.
  4. 4Update perimeter egress firewall rules to block the destination IP address and isolate the infected host into a quarantine VLAN.

Answer

The correct sequential order for triaging the network monitoring alert is: 1) Examine NetFlow data to confirm baseline deviation; 2) Inspect packet capture (PCAP) data to extract protocol metadata and destination IPs; 3) Query threat intelligence databases using extracted IP addresses to verify malicious activity; 4) Update firewall egress rules and place the host into a quarantine VLAN.
The standard security monitoring workflow dictates starting with broad alert validation (NetFlow baseline analysis), progressing to specific artifact extraction (PCAP inspection), contextualizing artifacts (threat intelligence correlation), and concluding with active mitigation (firewall blocking and VLAN quarantine).

Step-by-Step Solution

1
Verify initial alert validity using flow logs.
Confirmed baseline anomaly in traffic volume and session length.
Ensures the event is a true positive before dedicating technical resources to forensic capture analysis.
2
Perform full packet analysis on the flagged network stream.
Extracted destination IPs, port numbers, and TLS metadata artifacts.
Retrieves essential technical indicators required for threat identification.
3
Correlate collected indicators with reputational threat intelligence.
Confirmed destination IP belongs to known adversary Command and Control infrastructure.
Establishes threat severity and confirms the need for isolation controls.
4
Execute containment and isolation policies.
Blocked outbound connection attempts and isolated host from the internal network.
Prevents potential data exfiltration and halts lateral network movement.

Key Concept

Network Security Incident Triage and Response Workflow
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic