A Threat Feed Notes Malicious Actors Have Been Infiltrating Companies

question 68

Multiple Choice

A threat feed notes malicious actors have been infiltrating companies and exfiltrating data to a specific set of domains. Management at an organization wants to know if it is a victim. Which of the following should the security analyst recommend to identify this behavior without alerting any potential malicious actors?

• A) Create an IPS rule to block these domains and trigger an alert within the SIEM tool when these domains are requested.
• B) Add the domains to a DNS sinkhole and create an alert in the SIEM tool when the domains are queried
• C) Look up the IP addresses for these domains and search firewall logs for any traffic being sent to those IPs over port 443
• D) Query DNS logs with a SIEM tool for any hosts requesting the malicious domains and create alerts based on this information

---

Definitions:

Internet

A global network of networks; a communications system.

J1587/1708 Data Bus

A communications protocol used in the automotive industry, particularly in heavy-duty vehicles, for electronic control units to communicate.

CAN 2.0

See Control Area Network. The platform used as the data backbone for CAN-C (auto/light duty) and J1939 (truck/heavy equipment) serial data bus communications.

J1939 Data Bus

A communication network protocol based on CAN (Controller Area Network) designed for heavy-duty vehicle communication, enabling the interchange of electronic data between components.