Ravi Sir's Cyber Security Cards › Interview Cards
Connection established from an external IP – investigate and mitigate?
Connection established from an external IP – investigate and mitigate? Identify the process, user, destination, port, volume , and whether data left. If a strange process is sending large data to an unknown IP, isolate the host or block it at the firewall. “I find the process behind the connection,
Read card text
What this card says
Short answer
Identify the process, user, destination, port, volume, and whether data left.
Example
If a strange process is sending large data to an unknown IP, isolate the host or block it at the firewall.
Say it in the interview
“I find the process behind the connection, check if data left, then contain.”
Why it matters
An outbound connection can be data theft or command-and-control.
Learn more in the lesson: 47.4 SOC Analyst Round – SIEM, Triage, MITRE