nerdexam
CompTIA

CS0-003 · Question #523

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for…

The correct answer is C. Review the network logs to identify the context of traffic and what action was taken. The first action a SOC analyst should take in response to suspicious traffic uptick activities, especially with prior flags, is to review network logs to understand the context and actions taken regarding the traffic.

Submitted by alyssa_d· Mar 6, 2026Incident Response and Management

Question

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for DDoS attacks and reconnaissance scanning in the past year. Which of the following actions should a SOC analyst take first in response to these traffic uptick activities?

Options

  • ARecommend a firewall rule implementation to deny all traffic from the IP subnet.
  • BContinue monitoring because the traffic spike did not cause any security notifications or concerns.
  • CReview the network logs to identify the context of traffic and what action was taken.
  • DCheck the resource consumption levels to determine whether the uptick is due to a device

How the community answered

(18 responses)
  • A
    17% (3)
  • B
    6% (1)
  • C
    72% (13)
  • D
    6% (1)

Why each option

The first action a SOC analyst should take in response to suspicious traffic uptick activities, especially with prior flags, is to review network logs to understand the context and actions taken regarding the traffic.

ARecommend a firewall rule implementation to deny all traffic from the IP subnet.

Recommending a firewall rule to deny all traffic from a legitimate ISP subnet without further investigation could block legitimate users and services, causing undue business impact.

BContinue monitoring because the traffic spike did not cause any security notifications or concerns.

Continuing to monitor without investigation is negligent, especially given the history of DDoS and reconnaissance associated with the IPs, and could lead to a successful attack or continued resource abuse.

CReview the network logs to identify the context of traffic and what action was taken.Correct

Reviewing network logs provides critical context about the nature of the traffic, its destination, the services it interacted with, and any actions (e.g., block, allow) taken by security devices, which is essential before making further decisions or taking action.

DCheck the resource consumption levels to determine whether the uptick is due to a device

Checking resource consumption levels is a good subsequent step, but it typically follows an initial understanding of the traffic's nature obtained from logs, as abnormal consumption is a symptom rather than the full context.

Concept tested: Incident response initial investigation

Topics

#incident analysis#traffic spike#WAF logs#threat intelligence

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice