Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A network security monitoring (NSM) system triggers an automated alert indicating anomalous outbound TLS traffic from an enterprise host to an unrated external IP address. In what sequence should a network analyst execute the technical triage and mitigation workflow?

  1. 1Correlate NetFlow telemetry with SIEM log records to verify traffic volume and pinpoint the internal host IP address.
  2. 2Implement a temporary firewall rule to drop session traffic between the affected internal host and the external target IP address.
  3. 3Retrieve full packet capture (PCAP) files from the NSM sensor to analyze the TLS handshake and cipher suite attributes.
  4. 4Update inline NIPS rule definitions to automatically drop traffic matching the identified malicious payload indicators.

Answer

The correct operational sequence begins with correlating NetFlow and SIEM logs to confirm host identity, followed by deploying firewall containment rules to halt active connections. Next, packet capture analysis is performed on the sensor data, and finally, custom NIPS signature rules are updated to prevent recurrence.
The standard network security monitoring operational workflow dictates starting with alert validation via NetFlow/SIEM correlation to confirm affected assets, applying immediate firewall containment to stop exfiltration, conducting deep PCAP analysis to extract threat indicators, and updating inline NIPS signatures for long-term prevention.

Step-by-Step Solution

1
Correlate NetFlow telemetry with SIEM logs.
Confirmed the alert validity and identified the specific source IP address involved.
Initial scoping establishes whether an alert represents a true positive and pinpoints affected assets.
2
Enforce network containment using perimeter firewall filtering.
Outbound sessions between the source host and suspicious IP are terminated.
Prompt containment minimizes security impact and stops potential exfiltration channels.
3
Perform full packet capture (PCAP) inspection.
Identified anomalous payload headers and session metadata.
Detailed protocol analysis uncovers threat details required for long-term defensive tuning.
4
Deploy updated NIPS signature definitions across sensor nodes.
Automated blocking capabilities are activated for the specific threat profile.
Converting payload indicators into detection signatures protects the enterprise against repeated attempts.

Key Concept

Network Security Monitoring Triage and Response Workflow
Estimated Time:2m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic