Examkin

Question

Difficulty: Very hardNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst receives a high-priority alert indicating potential encrypted command-and-control (C2) beaconing originating from a domain controller. In what order should the analyst perform the following network security monitoring and triage steps to properly validate, investigate, and contain the incident?

  1. 1Correlate perimeter Network Intrusion Detection System (NIDS) alert metadata with NetFlow records and internal DNS query logs to confirm persistent outbound connection patterns.
  2. 2Query Endpoint Detection and Response (EDR) telemetry on the affected system to correlate the network socket with the underlying process ID and binary executable.
  3. 3Apply network isolation controls to the affected system at the network switch port or host agent level to prevent lateral movement while preserving volatile system memory.
  4. 4Update perimeter firewall rules and DNS sinkholes to block egress traffic to the identified external destination IP address and C2 domain across the enterprise.

Answer

The correct sequence begins with validating the NIDS alert against NetFlow and DNS records, followed by identifying the specific process via endpoint telemetry, isolating the host to prevent lateral movement, and finally enforcing perimeter blocking and DNS sinkholing.
The incident handling lifecycle requires starting with verification (correlating NIDS, NetFlow, and DNS logs), followed by context gathering (EDR process mapping), local containment (host network isolation to halt lateral spread while keeping power on), and global containment (perimeter firewall blocks and DNS sinkholing).

Step-by-Step Solution

1
Correlate network telemetry (NIDS, NetFlow, DNS).
Validates the alert authenticity and confirms persistent beaconing behavior.
Security monitoring protocols mandate verifying alerts against baseline NetFlow and DNS logs to eliminate false positives before taking invasive actions.
2
Inspect host endpoint logs (EDR process correlation).
Identifies the malicious process ID and executable tied to the network connection.
Network alerts identify IP/port pairings, but pinpointing the malicious actor on the system requires matching sockets to host processes.
3
Execute targeted host containment (network isolation).
Prevents lateral movement while keeping the system powered for forensic memory capture.
Isolating the compromised domain controller prevents adversaries from moving laterally to other critical assets.
4
Implement enterprise perimeter indicators of compromise (IoC) block rules.
Shields all other enterprise hosts from communicating with the external C2 infrastructure.
Broad perimeter blocking and DNS sinkholing ensure enterprise-wide containment after host-level containment is established.

Key Concept

Incident Response Lifecycle for Network Security Monitoring
Estimated Time:3m 0s
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic