300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ51

Threat Hunting Techniques

Refer to the exhibit.

Question Image

A security analyst receives a Cisco Secure Network Analytics (formerly StealthWatch) alert in the C2 category. Which information helps with the investigation?

Explanation

The subject IP address, 10.201.3.99, is the endpoint initiating the observed HTTP connection, and the payload identifies the remote URL involved in the C2 activity. This indicates that the host is attempting to contact C2 infrastructure to retrieve the payload.

Community Discussion

No comments yet. Be the first to start the discussion!