A security analyst is investigating malicious traffic from an internal system that attempted to download proxy avoidance as identified from the firewall logs, but the destination IP is blocked and not captured. Which of the following should the analyst do?
A) Shut down the computer
B) Capture live data using Wireshark
C) Take a snapshot
D) Determine if DNS logging is enabled
E) Review the network logs

Question

Quizplus · Accepted Answer

Determining if DNS logging is enabled can help identify the domain names associated with the malicious traffic, providing more context about the attempted connections.

A Security Analyst Is Investigating Malicious Traffic from an Internal