Question

You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?

Answer 1

Answer:You are a security officer of a company. You had an alert from IDS that indicate one PC on your Intranet connected to a blacklisted IP address(C2 Server) on the Internet. The IP address was blacklisted just before of the alert. You are starting investigation to know the severity of situation roughly. Which of the following is appropriate to analyze?

IDS log

Event logs on the PC

Event logs on domain controller

Internet Firewall/Proxy log

(Answer: D)

Explanation: