300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

Question

A security analyst receives a SIEM notification that an internal host has active connections to Tor exit nodes. While investigating SIEM events for the workstation, the analyst determines that the host is scanning networks for servers with TCP port 1433 open. An antivirus scan of the workstation finds no suspicious activity.

Which two actions must the analyst take to mitigate this behavior?

Choose two

A Configure SIEM alert rules to perform quick response and mitigation.
B Deploy EDR and SOAR for automatic quarantine of actions from suspicious hosts.
C Create a Cisco Secure Network Analytics notification rule to further investigate port scanning activity.
D Block Tor nodes via an NGFW and restrict access to SQL only from trusted sources.
E Block any connection to TCP port 1433 from external sources.

Explanation

EDR and SOAR can automatically contain or quarantine a suspicious endpoint when conventional antivirus does not identify the activity. Blocking Tor nodes at the next-generation firewall disrupts the host’s Tor communications, and restricting SQL Server access to trusted sources limits exposure of TCP 1433 services to the internal port scan. SQL Server’s default instance uses TCP port 1433, and firewall access should be limited to authorized users or computers.

Learn more

300-215 CBRFIR: Conducting Forensic Analysis and Incident Response Using Cisco Technologies for CybersecurityDemo

AstroTutor

Notes

Readiness

QuestionQ119

Community Discussion