Question

A security analyst receives an alert that host A, with the IP address `192.168.5.39`, has had a new browser extension installed. While investigating SIEM tool logs, the analyst finds that host A made continuous TCP connections to `1.25.241.8` over TCP port 80. The IP address `1.25.241.8` is categorized as a C2 server. Which action should the analyst take to mitigate similar connections going forward?

Accepted Answer

D. Configure a browser extension deny list.

Answer

Use antivirus software to quarantine suspicious files automatically.

Answer

Use Deep Packet Inspection to block malicious domains.

Answer

Use IDS to detect and avoid similar connections.