Exam CAS-004 topic 1 question 428 discussion

IoC1: Analisys: "An application is performing an automatic update" It is a CNAME resolution sequence. 1. Apache_httpd is initiating DNS queries 2. The DNS queries go through two internal DNS servers (10.1.1.1 and 10.1.2.5) 3. The third entry appears to query the domain 3a129sk219r0slmfxzzz000.s.domain, likely as a result of the CNAME returned previously 4. The last query resolves this CNAME to the actual IP address (108.158.253.253), which is likely the server the Apache HTTP service is trying to reach. Remediation: "No further action is needed" IoC2 and IoC3: I agree with the given answers.

Given answer is correct. IoC1: Analysis: "Canonical name records in a public DNS cache are being updated." Remediation: "Configure the DNS server to perform recursion." IoC2: Analysis: "Someone is footprinting a network subnet." Remediation: "Block ping requests across the WAN interface." IoC3: Analysis: "An employee is using P2P services to download files." Remediation: "Enforce endpoint controls on third-party software installations."

IOC 1: This is a DNS canonical name (CNAME) update. Is this malicious? Unknown, but it certainly looks suspicious. Solution: Configure the DNS server to perform recursion. This will allow the server to query other DNS servers to validate requests which reduces the likelihood of malicious updates. IOC 2: Someone is footprinting a network subnet. A single source IP addres with pings to incrementing IP addresses. Solution: The log indicates the network device is droping ICMP requests. No further action is needed. As a side note, if this WERE coming across the WAN interface we wouldnt have a private IP address as the source. IOC 3: An employess is using P2P services to download files. A GET request for x-bittorrent.gzip from an external IP (2.1.0.0) with a successful HTTP response (200). Solution: Enforce endpoint controls on third-party software installation.

i partially agree with these. IOC 1:analysis - application is performing an update (The evidence is more toward an application updating initiated by the web server which is behavior for an update. Remediation: nothing . IOC2:analysis- footprinting a subnet remediation - block ping requests. IOC3: analysis - Employe using PTP to download files remediation - blocklist of malicious ports

Hi guys, is given answer correct