312-39V2: Certified SOC Analyst v2

Question

Mark Reynolds, an SOC analyst at a global financial institution, is in the eradication phase of an incident-response plan after identifying a wave of phishing attacks aimed at employees. To ensure attackers cannot reuse their malicious infrastructure, Mark deploys a technique that blocks known malicious IP addresses used to send spam emails at the Domain Name System level. Which of the following techniques is most suitable for this purpose?

Explanation

DNS blackholing applies DNS-based policy to block or discard requests involving known malicious infrastructure, preventing internal systems from resolving or reaching it. DNS filtering commonly uses threat blocklists to stop connections to known suspicious IP addresses or domains, including infrastructure associated with phishing.

Learn more

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ29

Community Discussion