CAS-002 · Question #824
The network administrator at an enterprise reported a large data leak. One compromised server was used to aggregate data from several critical application servers and send it out to the Internet…
The correct answer is A. Review the flow data against each server's baseline communications profile. Network flow data compared against baseline communication profiles reveals anomalous server-to-server connections that show how a compromised server aggregated data internally.
Question
The network administrator at an enterprise reported a large data leak. One compromised server was used to aggregate data from several critical application servers and send it out to the Internet using HTTPS. Upon investigation, there have been no user logins over the previous week and the endpoint protection software is not reporting any issues. Which of the following BEST provides insight into where the compromised server collected the information?
Options
- AReview the flow data against each server's baseline communications profile.
- BConfigure the server logs to collect unusual activity including failed logins and restarted services.
- CCorrelate data loss prevention logs for anomalous communications from the server.
- DSetup a packet capture on the firewall to collect all of the server communications.
How the community answered
(44 responses)- A55% (24)
- B9% (4)
- C14% (6)
- D23% (10)
Why each option
Network flow data compared against baseline communication profiles reveals anomalous server-to-server connections that show how a compromised server aggregated data internally.
NetFlow or sFlow data captures metadata about all network conversations - source, destination, port, and volume - without requiring deep packet inspection. Comparing current flow records against each application server's established baseline communication profile exposes unauthorized lateral connections that the compromised server used to collect data, even when endpoint protection and login logs show nothing unusual. This historical network-layer visibility fills the gap left by failed endpoint and identity controls.
Configuring logs after the incident only captures future activity and cannot reconstruct the historical aggregation paths already used by the attacker.
DLP logs focus on egress of sensitive data at the perimeter and do not provide visibility into internal server-to-server communications used during the aggregation phase.
A packet capture configured now captures only future traffic and misses all communication that already occurred during the data collection period.
Concept tested: Network flow analysis for lateral movement investigation
Source: https://csrc.nist.gov/publications/detail/sp/800-94/rev-1/draft
Topics
Community Discussion
No community discussion yet for this question.