Examkin

Question

Difficulty: Very hardNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst receives a high-severity Network Intrusion Prevention System (NIPS) alert indicating potential unauthorized data exfiltration from a core database host to an external IP address. Place the incident response steps in the correct operational sequence, starting from initial alert validation through threat intelligence integration.

  1. 1Examine the NIPS alert payload and NetFlow volume metrics to confirm that an active, high-volume outbound data transfer is occurring.
  2. 2Query SIEM log aggregation tools to correlate the source IP with endpoint authentication logs and recent execution events.
  3. 3Apply an emergency VLAN isolation policy at the network switch to sever outbound communication paths for the database host.
  4. 4Conduct deep packet inspection on captured PCAP files from perimeter taps to extract Command and Control (C2) domains and file hashes.
  5. 5Update enterprise NIDS/NIPS signature databases and perimeter firewall blocklists with the extracted IOCs.

Answer

The correct operational sequence begins with validating the alert using NetFlow and NIPS payload data, followed by SIEM log correlation for host context, executing network isolation to halt exfiltration, conducting PCAP forensic analysis to extract IOCs, and updating enterprise monitoring signatures and blocklists.
In standard network security incident operations, analysts must first validate the NIPS alert with NetFlow data to confirm true positive status. Next, SIEM correlation provides necessary endpoint and host context. Once verified, network containment (VLAN isolation) must be implemented immediately to halt data loss. After containment, PCAP analysis extracts specific C2 indicators, which are finally ingested into NIDS/NIPS signatures and perimeter blocklists to protect the broader network.

Step-by-Step Solution

1
Analyze NIPS alert payload and NetFlow traffic statistics.
Validation of the network anomaly as a true positive event.
Alert validation prevents misallocating response resources to false positives.
2
Query SIEM for host authentication and endpoint telemetry.
Identification of compromised accounts or malicious processes on the source host.
Establishes host-level context and potential root cause following traffic verification.
3
Enforce dynamic VLAN isolation on the network infrastructure.
Immediate containment of data exfiltration and restriction of lateral movement.
Containment takes immediate priority over detailed forensics once a threat is confirmed.
4
Analyze full packet capture (PCAP) files collected during the event window.
Extraction of actionable C2 domains, IP addresses, and payload hashes.
Forensic investigation can be performed safely after the active threat pathway is severed.
5
Incorporate newly discovered IOCs into NIDS/NIPS detection rules and blocklists.
Enhanced detection coverage against the adversary's infrastructure across the organization.
Ensures long-term resilience and real-time alerting for similar threat vectors.

Key Concept

Network Incident Response Lifecycle & Monitoring Workflow
Rate this question

Topics

Network Security Monitoring and Alerting

More questions from this topic