Exam CS0-003 topic 1 question 361 discussion

Actual exam question from CompTIA's CS0-003

Question #: 361
Topic #: 1

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for DDoS attacks and reconnaissance scanning in the past year. Which of the following actions should a SOC analyst take first in response to these traffic uptick activities?

A. Recommend a firewall rule implementation to deny all traffic from the IP subnet.
B. Continue monitoring because the traffic spike did not cause any security notifications or concerns.
C. Review the network logs to identify the context of traffic and what action was taken.
D. Check the resource consumption levels to determine whether the uptick is due to a device performance issue.

Show Suggested Answer

Suggested Answer: C 🗳️

by jasondion69 at May 2, 2025, 8:17 p.m.

Comments

Submit Cancel

3eb5fb6

1 month, 1 week ago

Selected Answer: C

C. Before taking any corrective measures, it's critical to gather and analyze more detailed information about the reported spike. By reviewing the network and WAF logs, you can determine the nature and intent of the traffic – whether it appears benign, is an early warning sign of malicious scanning or DDoS behavior, or potentially something else. This investigation will help you understand the context, discern any correlation with other security events, and validate whether immediate blocking or additional mitigation tactics (like firewall rules) are necessary. Jumping straight to a firewall rule may block legitimate traffic, and simply monitoring without analysis might let an emerging threat go unnoticed.

upvoted 2 times

...

jasondion69

1 month, 3 weeks ago

Selected Answer: C

It's C

upvoted 1 times

...