312-50V11 · Question #73
You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address…
The correct answer is B. Internet Firewall/Proxy log. The Internet Firewall/Proxy log is the most appropriate source for analyzing the scope and severity of a suspected C2 connection from an internal host to a blacklisted external IP.
Question
You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?
Options
- AEvent logs on the PC
- BInternet Firewall/Proxy log
- CIDS log
- DEvent logs on domain controller
How the community answered
(53 responses)- A4% (2)
- B77% (41)
- C8% (4)
- D11% (6)
Why each option
The Internet Firewall/Proxy log is the most appropriate source for analyzing the scope and severity of a suspected C2 connection from an internal host to a blacklisted external IP.
Event logs on the PC capture local application and OS activity but do not record the full details of outbound network sessions to the external C2 server.
Firewall and proxy logs record all inbound and outbound network connections, capturing details such as timestamps, data volume, and connection frequency between the internal PC and the external C2 server. This data allows the security officer to determine when the connection started, how much data was transferred, and whether other hosts are involved. These details are critical for assessing the full scope of a potential compromise.
The IDS log shows only the specific alert that was triggered and lacks the broader historical network traffic context needed to assess overall severity.
Domain controller event logs capture authentication and directory service events and do not contain records of network-level communications to external IP addresses.
Concept tested: Incident investigation using firewall and proxy logs
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf
Topics
Community Discussion
No community discussion yet for this question.