ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 266 - SY0-601 discussion

Report
Export

Multiple beaconing activities to a malicious domain have been observed. The malicious domain is hosting malware from various endpoints on the network. Which of the following technologies would be best to correlate the activities between the different endpoints?

A.
Firewall
Answers
A.
Firewall
B.
SIEM
Answers
B.
SIEM
C.
IPS
Answers
C.
IPS
D.
Protocol analyzer
Answers
D.
Protocol analyzer
Suggested answer: B

Explanation:

SIEM stands for Security Information and Event Management, which is a technology that collects, analyzes, and correlates data from multiple sources, such as firewall logs, IDS/IPS alerts, network devices, applications, and endpoints. SIEM provides real-time monitoring and alerting of security events, as well as historical analysis and reporting for compliance and forensic purposes. A SIEM technology would be best to correlate the activities between the different endpoints that are beaconing to a malicious domain. A SIEM can detect the malicious domain by comparing it with threat intelligence feeds or known indicators of compromise (IOCs). A SIEM can also identify the endpoints that are communicating with the malicious domain by analyzing the firewall logs and other network traffic data. A SIEM can alert the security team of the potential compromise and provide them with relevant information for investigation and remediation.

asked 02/10/2024
Dan Yann
47 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first