Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A security analyst investigates a SIEM alert triggered by a Network Traffic Analysis (NTA) sensor monitoring an internal enterprise workstation subnet. The flow log snippet displays the following sequential network events:

Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.0.4.15 | DstIP: 192.168.1.50 | DstPort: 445 | Protocol: TCP | Flags: SYN
Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.0.4.15 | DstIP: 192.168.1.51 | DstPort: 445 | Protocol: TCP | Flags: SYN
Timestamp: 2026-07-27T14:02:11Z | SrcIP: 10.0.4.15 | DstIP: 192.168.1.52 | DstPort: 445 | Protocol: TCP | Flags: SYN
Timestamp: 2026-07-27T14:02:12Z | SrcIP: 10.0.4.15 | DstIP: 192.168.1.53 | DstPort: 445 | Protocol: TCP | Flags: SYN

Based on the network security monitoring logs, which of the following actions should the analyst take first to address this threat?

  1. A
    Reconfigure the NTA sensor to act as an inline honeypot that actively drops all TCP port 445 traffic across the workstation subnet.
  2. Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.Answer
  3. C
    Update perimeter edge firewall rules to block inbound TCP port 445 traffic from external internet addresses.
  4. D
    Document the alert as a detective control functioning to automatically block password brute-force attempts.

Answer

Isolate host 10.0.4.15 from the network to contain automated lateral movement reconnaissance.
The flow logs show host 10.0.4.15 initiating rapid TCP SYN connection requests on port 445 (SMB) across consecutive destination IP addresses. This pattern represents an internal IP sweep, commonly used by compromised hosts during lateral movement to discover network shares and active hosts. The immediate priority in network security operations is isolating the compromised source host to contain potential worm or ransomware spread.

Step-by-Step Solution

1
Analyze the log flow entries for patterns in source IP, destination IP, port, and TCP flags.
Identified host 10.0.4.15 attempting sequential TCP SYN connections to port 445 across multiple internal targets (192.168.1.50-53) within one second.
Sequential port/service probing from a single internal source indicates automated network reconnaissance/horizontal IP sweeping for vulnerable SMB services.
2
Determine the appropriate incident response containment action based on network monitoring findings.
Host 10.0.4.15 must be isolated immediately to prevent further lateral scanning or infection spreading across the enterprise network.
Network isolation stops compromised internal assets from discovering and exploiting neighboring systems via SMB.

Key Concept

Network Reconnaissance and Incident Containment
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic