Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) receives an automated alert generated by a Network Intrusion Prevention System (NIPS) detecting an remote code execution (RCE) payload targeted at an internal API server. In what chronological sequence should a security analyst perform the initial response actions from alert ingestion through recovery?

  1. 1The NIPS sensor flags the inbound HTTP request matching an RCE signature and generates a high-severity alert.
  2. 2The SOC analyst correlates the alert timestamp with SIEM events to verify target IP status and payload execution.
  3. 3The analyst isolates the impacted API server from the network segment to limit potential lateral movement.
  4. 4The security team extracts full packet captures (PCAP) and host memory artifacts to identify indicators of compromise (IoCs).
  5. 5The team applies security patches to the API application and restores the server to production after integrity verification.

Answer

The correct operational sequence is: 1) Initial NIPS detection and alert generation, 2) SIEM log correlation and alert verification, 3) Host isolation for network containment, 4) Deep PCAP and forensic artifact investigation, and 5) Vulnerability patching and system restoration.
In standard network security operations, alert handling follows a structured sequence: Detection (NIPS alert), Identification/Correlation (SIEM log verification), Containment (host isolation), Forensics/Analysis (PCAP and artifact review), and Eradication/Recovery (patching and system restoration).

Step-by-Step Solution

1
Identify the alert trigger
The NIPS flags suspicious inbound API traffic and generates a security event.
Security monitoring systems must first capture anomalies and alert security personnel.
2
Triage and correlate logs
SIEM correlation confirms a true positive event targeting an active API endpoint.
Analysts must validate alerts against contextual log data to rule out false positives.
3
Execute containment
The target API server is segmented/isolated from the corporate network.
Preventing lateral movement takes operational precedence over deep technical investigation.
4
Perform forensic investigation
PCAP analysis and host memory extraction reveal scope and indicators of compromise.
Forensic data capture determines whether payload execution was successful and what data was accessed.
5
Eradicate and restore
The application flaw is remediated and the host is restored safely to service.
Remediation prevents re-infection upon bringing systems back online.

Key Concept

Network Alert Triage and Incident Response Lifecycle
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic