A security technician is configuring network security monitoring rules to detect active compromises and data exfiltration. Which of the following observations represent valid network-level threat indicators that should trigger an immediate security alert? (Select TWO.)
- Outbound network flow logs showing persistent connection attempts to known malicious Command and Control (C2) IP addressesAnswer
- Network Intrusion Detection System (NIDS) alerts identifying anomalous ICMP packet payloads containing encoded data transfers from an internal serverAnswer
- CA honeypot decoy system inline-filtering and dropping inbound malicious traffic to protect production servers
- DWeb application gateway logs marking an HTTP payload containing SQL database commands as a client-side Cross-Site Scripting attack
Answer
The valid indicators of network-based compromise requiring alerts are persistent outbound connections to known Command and Control (C2) IP addresses and NIDS alerts identifying anomalous ICMP packet payloads carrying encoded data.
Outbound connection attempts to known Command and Control infrastructure and protocol anomalies like data-laden ICMP payloads represent real-time network layer telemetry indicating compromised internal assets and active tunneling, making both essential network alert triggers.
Step-by-Step Solution
Key Concept
Network Security Monitoring and Alerting