Examkin

Soru

Zorluk: OrtaNetwork Security Monitoring and Alerting

A Security Operations Center (SOC) analyst reviewing network security monitoring (NSM) alerts identifies sustained IP protocol 47 (Generic Routing Encapsulation - GRE) traffic originating from an internal DMZ web server toward an unknown external IP address. NetFlow records confirm a high volume of asymmetric outbound data transfer. Which TWO of the following actions should the analyst take to address this network security incident?

  1. Isolate the compromised host from the network segment to halt active data exfiltration.Cevap
  2. Configure perimeter egress firewall rules to block unauthorized GRE traffic from leaving the network.Cevap
  3. C
    Modify the web application code to enforce parameterized database queries.
  4. D
    Reconfigure an internal honeypot sensor to inline mode to drop unauthorized packets.

Cevap

The analyst should isolate the compromised host from the network segment and configure perimeter egress firewall rules to block unauthorized GRE traffic.
Isolating the compromised server stops immediate outbound tunneling, while updating egress firewall rules prevents unauthorized GRE protocol traffic from crossing the enterprise boundary.

Adım Adım Çözüm

1
Identify the network anomaly and attack vector from the NSM alert.
Unapproved IP protocol 47 (GRE) tunneling indicates network layer encapsulation and unauthorized data exfiltration.
Recognizing GRE misuse helps pinpoint containment actions at both host and network perimeter levels.
2
Apply host-level containment.
Network isolation of the DMZ web server stops immediate communication with the external endpoint.
Host isolation prevents lateral movement and halts outgoing exfiltration channels.
3
Enforce network-level egress filtering.
Perimeter firewall rules blocking unapproved GRE traffic stop similar covert tunneling attempts enterprise-wide.
Egress filtering ensures defense-in-depth across the network boundary.

Anahtar Kavram

Network Traffic Anomaly Detection and Egress Containment
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Network Security Monitoring and Alerting

Bu konudan daha fazla soru