GCIH: GIAC Certified Incident HandlerDemo

Question

A company is reviewing its systems. The review covers travelling laptops with insecure connections and focuses on identifying connections to known malicious locations. What is an efficient way to accomplish this task?

A Review DNS logs and caches from all machines against listing of malware domains
B Sort logs from the web proxy for requests made against listings of malware domains
C Go through logs from the company firewall for connections to known bad sites
D Check VPN logs for the connections made by travelling laptops

Explanation

DNS logs and DNS caches can identify domain lookups made by endpoints, including laptops whose traffic may not traverse the organization’s web proxy, firewall, or VPN. Comparing those records with a current list of known malicious domains efficiently identifies suspected malicious connections.

GCIH: GIAC Certified Incident HandlerDemo

AstroTutor

Notes

Readiness

QuestionQ675

Community Discussion