Soru

Zorluk: KolayNetwork Security Monitoring and Alerting

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

  1. 1Validate the initial network alert to verify whether it represents a real security event or a false positive.
  2. 2Examine relevant packet captures and netflow logs to determine the scope and nature of the network activity.
  3. 3Isolate the affected workstation from the network to prevent potential lateral movement or data exfiltration.
  4. 4Document the monitoring findings and notify the incident response team for escalation.

Cevap

The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.

Adım Adım Çözüm

1
Alert Validation
Confirmed genuine alert requiring investigation.
Before acting on an alert, security analysts must rule out false positives.
2
Telemetry & Log Analysis
Identified destination IP address and traffic volume.
Reviewing packet captures and network flows helps identify the exact nature and extent of the threat.
3
Host Containment
Workstation disconnected from local subnet.
Preventing lateral movement or exfiltration is critical once suspicious activity is confirmed and scoped.
4
Documentation & Escalation
Alert ticket updated and escalated to tier-2 incident response.
Proper documentation ensures complete chain-of-custody and smooth operational handoff.

Anahtar Kavram

Network Security Monitoring Triage & Incident Workflow
Bu soruyu puanla