The network administrator at an enterprise reported a large data leak. One compromised server was used to aggregate data from several critical application servers and send it out to the Internet…

Question

Options

• AReview the flow data against each server's baseline communications profile.
• BConfigure the server logs to collect unusual activity including failed logins and restarted services.
• CCorrelate data loss prevention logs for anomalous communications from the server.
• DSetup a packet capture on the firewall to collect all of the server communications.

• A
  70% (32)
• B
  17% (8)
• C
  9% (4)
• D
  4% (2)

Explanation

Network logging tools such as Syslog, DNS, NetFlow, behavior analytics, IP reputation, honeypots, and DLP solutions provide visibility into the entire infrastructure. This visibility is important because signature-based systems are no longer sufficient for identifying the advanced attacker that relies heavily on custom malware and zero-day exploits. Having knowledge of each host's communications, protocols, and traffic volumes as well as the content of the data in question is key to identifying zero-day and APT (advance persistent threat) malware and agents. Data intelligence allows forensic analysis to identify anomalous or suspicious communications by comparing suspected traffic patterns against normal data communication behavioral baselines. Automated network intelligence and next-generation live forensics provide insight into network events and rely on analytical decisions based on known vs. unknown behavior taking place within a corporate network.

No community discussion yet for this question.