300-215 · Question #142
During a recent incident response investigation, several suspicious network connections originating from a specific host were identified. The host was quickly isolated and the machine was rebuilt…
The correct answer is A. NetFlow data and host firewall logs D. user authentication logs and packet capture data. NetFlow data provides scalable, historical visibility into who the host talked to, when, and how much data moved, even when full packet data is unavailable. Host firewall logs add endpoint- level allow/deny decisions and local port/process context that complements flow…
Question
During a recent incident response investigation, several suspicious network connections originating from a specific host were identified. The host was quickly isolated and the machine was rebuilt. During the post mortem, it became clear that there was unpreparedness regarding network artifacts, necessitating adjustments to the playbooks. To address this, data from multiple sources must be correlated. Which two sources should be prioritized for data gathering? (Choose two.)
Options
- ANetFlow data and host firewall logs
- Bapplication and system error logs
- CDNS logs and web server logs
- Duser authentication logs and packet capture data
- Eantivirus alerts and system event logs
How the community answered
(26 responses)- A81% (21)
- B4% (1)
- C12% (3)
- E4% (1)
Explanation
NetFlow data provides scalable, historical visibility into who the host talked to, when, and how much data moved, even when full packet data is unavailable. Host firewall logs add endpoint- level allow/deny decisions and local port/process context that complements flow telemetry. Packet capture data provides the highest-fidelity evidence of the actual sessions (protocols, payload patterns, C2/exfil behaviors), and correlating it with user authentication logs links the suspicious connections to specific accounts, sessions, and timelines for accurate attribution and
Topics
Community Discussion
No community discussion yet for this question.