Examkin

Question

Difficulty: MediumNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst receives a high-priority alert regarding anomalous network traffic detected by a NetFlow monitoring tool. The flow logs reveal continuous, high-volume ICMP Echo Request traffic originating from an internal server to an unknown external IP address, with each packet carrying an unusually large payload of 1,400 bytes. Which of the following statements accurately interpret this network activity and specify the appropriate initial containment steps? (Select TWO.)

  1. The observed traffic pattern indicates potential covert data exfiltration utilizing ICMP tunneling.Answer
  2. The analyst should isolate the internal server from the network and block the remote IP address at the perimeter firewall.Answer
  3. C
    The traffic signature signifies a cross-site scripting (XSS) attack targeting web application database queries.
  4. D
    The analyst should reconfigure an internal honeypot to act as an inline packet-filtering control to drop the anomalous traffic.

Answer

The network log pattern indicates potential covert data exfiltration via ICMP tunneling, and the analyst's immediate containment response must include isolating the internal server and blocking the external destination IP address at the firewall.
ICMP Echo Request packets with oversized payloads (such as 1,400 bytes) sent continuously to an external address are a classic indicator of ICMP tunneling, a technique used by adversaries to exfiltrate sensitive data inside standard ICMP traffic. In response to suspected ongoing data exfiltration, standard security incident containment protocol dictates isolating the compromised source system from the network to halt internal movement and blocking the external target IP address on perimeter firewalls to prevent further outbound flow.

Step-by-Step Solution

1
Analyze the NetFlow anomaly and packet payload attributes.
Identified high-volume ICMP Echo Requests carrying 1,400-byte payloads destined for an external IP address.
Standard ICMP requests carry negligible data payloads; large custom payloads indicate covert protocol tunneling used to exfiltrate data past port-based firewall restrictions.
2
Evaluate incident containment best practices for covert data exfiltration.
Determined that network isolation of the host and blocking the remote destination IP address stops ongoing exfiltration.
Isolating the internal asset prevents further unauthorized communication while perimeter block rules prevent additional outbound connections to the threat actor's infrastructure.

Key Concept

Network Security Monitoring & ICMP Tunneling Detection
Estimated Time:1m 30s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic