Examkin

Soru

Zorluk: Çok zorNetwork Security Monitoring and Alerting

An enterprise network security engineer evaluates telemetry from a perimeter Network Intrusion Detection System (NIDS) and flow collector monitoring a secure database VLAN. The monitoring system flagged outbound encrypted connections over TCP port 443 originating from internal database server 10.0.4.15 toward an external destination.

AttributeValue / Captured Telemetry
Source IP & Port10.0.4.15 : 49152
Destination IP & Port198.51.100.42 : 443
Flow VolumeBytes Sent: 4,820,100 \Bytes Received: 1,200
TLS Server Name Indication (SNI)update.vendor-cloud-services.com
JA3 TLS Fingerprint7715705b32eef410403f9b223bc6a136 (Known C2 toolkit hash)
Reverse DNS Lookuphost42.unknown-bulletproof-host.net

Based on the network security monitoring data, which of the following represents the most accurate diagnosis of the activity and the appropriate immediate action?

  1. The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.Cevap
  2. B
    The payload indicates a database-targeted Cross-Site Scripting (XSS) attack executing client-side scripts via TLS SNI header manipulation; a WAF rule should be deployed to sanitize the SNI field.
  3. C
    The imbalance in byte transfer confirms that an inline deception honeypot successfully captured and contained the attack; no further incident response actions are required.
  4. D
    The high outbound byte volume signals a local buffer overflow vulnerability on the database server; a software vendor patch should be applied to prevent host memory corruption.

Cevap

The telemetry indicates domain fronting or SNI spoofing used for data exfiltration to a malicious command-and-control server; the host 10.0.4.15 should be isolated immediately.
The network security monitoring telemetry presents key indicators of encrypted data exfiltration over TCP port 443. The high volume of outbound bytes (4.8 MB) relative to inbound bytes (1.2 KB), combined with a JA3 fingerprint matching known malicious C2 software and a reverse DNS mismatch against the requested TLS SNI, confirms domain fronting / SNI spoofing. The immediate requirement in incident triage is isolating the host from the network to halt exfiltration.

Adım Adım Çözüm

1
Analyze flow volume telemetry
Identified massive outbound data transfer (4.8 MB sent vs. 1.2 KB received), indicating active data exfiltration rather than standard operational traffic.
High ratio of sent to received data on database servers is a key indicator of compromise.
2
Correlate TLS headers with network intelligence
The TLS Server Name Indication (SNI) claims to be a legitimate vendor service, but the reverse DNS points to an untrusted host, and the JA3 TLS fingerprint matches a known malicious command-and-control (C2) framework.
Discrepancy between SNI hostnames and JA3 fingerprints indicates SNI spoofing or domain fronting techniques used by adversaries to bypass simple domain blocklists.
3
Determine containment priority
Select host containment and network isolation as the immediate incident response action.
Active data exfiltration and C2 activity require immediate containment to stop ongoing data loss before conducting root-cause analysis.

Anahtar Kavram

Network Security Monitoring & TLS Egress Anomaly Detection
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru