Câu 17: NetSec-Analyst: Palo Alto Networks Certified Network Security Analyst

An alert indicates that multiple internal endpoints are communicating with a known malicious IP address, and the analyst needs to identify the scope of this activity by using Log Viewer. What is the first step in identifying which internal hosts have communicated with the malicious IP address and determining the extent of the communication?

1. A. Filter the traffic logs by the known endpoint IP addresses.
2. B. Filter the traffic logs by the DNS Server's IP address.
3. C. Filter the traffic logs by the NGFWs IP addresses.
4. D. Filter the traffic logs by the malicious IP address. — đáp án hiện tại