nerdexam
CompTIA

SY0-501 · Question #386

An organization identifies a number of hosts making outbound connections to a known malicious IP over port TCP 80. The organization wants to identify the data being transmitted and prevent future…

The correct answer is D. Use a protocol analyzer to reconstruct the data and blacklist the IP on the firewall. To identify past data transmitted to a malicious IP and prevent future connections, an organization should use a protocol analyzer for data reconstruction and blacklist the IP on a firewall.

Submitted by katya_ua· Mar 4, 2026Security operations

Question

An organization identifies a number of hosts making outbound connections to a known malicious IP over port TCP 80. The organization wants to identify the data being transmitted and prevent future connections to this IP. Which of the following should the organization do to achieve this outcome?

Options

  • AUse a protocol analyzer to reconstruct the data and implement a web-proxy.
  • BDeploy a web-proxy and then blacklist the IP on the firewall.
  • CDeploy a web-proxy and implement IPS at the network edge.
  • DUse a protocol analyzer to reconstruct the data and blacklist the IP on the firewall.

How the community answered

(50 responses)
  • A
    18% (9)
  • B
    6% (3)
  • C
    4% (2)
  • D
    72% (36)

Why each option

To identify past data transmitted to a malicious IP and prevent future connections, an organization should use a protocol analyzer for data reconstruction and blacklist the IP on a firewall.

AUse a protocol analyzer to reconstruct the data and implement a web-proxy.

While a protocol analyzer helps with data identification, a web-proxy primarily handles HTTP/HTTPS traffic and is not the most comprehensive or direct method to prevent all future connections to a known malicious IP at the network edge compared to a firewall blacklist.

BDeploy a web-proxy and then blacklist the IP on the firewall.

Deploying a web-proxy primarily helps prevent future connections and logs some data, but it does not facilitate the reconstruction of previously transmitted data for forensic analysis in the same way a protocol analyzer does.

CDeploy a web-proxy and implement IPS at the network edge.

Neither a web-proxy nor an Intrusion Prevention System (IPS) is designed to reconstruct data from past connections for forensic analysis, which is a key requirement of the problem statement.

DUse a protocol analyzer to reconstruct the data and blacklist the IP on the firewall.Correct

Using a protocol analyzer allows for deep packet inspection and reconstruction of the data streams transmitted over TCP 80, directly addressing the need to "identify the data being transmitted." Blacklisting the malicious IP on the firewall ensures that all future outbound (and inbound) connections to that specific IP address are blocked at the network perimeter, fulfilling the requirement to "prevent future connections to this IP."

Concept tested: Network forensics and firewall threat containment

Source: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Topics

#protocol analyzer#malicious traffic#network forensics#firewall blacklisting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice