300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

During an overnight shift, a cybersecurity team at a global trading firm identifies irregular activity. The network intrusion system flags a spike in encrypted traffic from high-value transaction servers to an anonymous Tor exit node. At the same time, internal surveillance tools report unusual database queries and access patterns that resemble exfiltration techniques. Which focused action should the team take first to analyze and address these possible security threats?

A Implement dynamic firewall rules to block suspicious outbound connections.
B Engage advanced decryption and anomaly analysis for the flagged traffic.
C Cross-reference database access logs with user activity profiles.
D Initiate immediate containment protocols for transaction servers.

Explanation

Indicators of possible active data exfiltration from high-value transaction servers require immediate containment to stop further unauthorized access or data transfer and to preserve the environment for investigation. Incident-response guidance treats containment as an early priority when potential damage or theft of resources is present; deeper traffic and log analysis can proceed after the affected systems are isolated.

Learn more

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ116

Community Discussion