Incident Response · Topic 2 of 6
Responding to Network Security Incidents
Learn how a SOC detects, contains and recovers from network incidents such as DoS, scanning, unauthorized access and spoofing for the CSA 312-39 exam.
- 5 min
- Firewall, IDS/IPS, NetFlow, DNS and device logs are the main network evidence.
- Internal scanning usually means an internal host is already compromised.
- DDoS containment is rate limiting and upstream filtering, not blocking single IPs.
What it is
A network security incident is an attack that uses or targets the network itself. Common examples are reconnaissance scans, denial of service (DoS and DDoS), unauthorized access to network devices, man in the middle attacks such as ARP spoofing, DNS poisoning, and wireless attacks like rogue access points.
The SOC's job is to confirm the attack from network evidence, contain it with network controls, remove the cause and restore normal traffic.
How it works
Detection sources
| Source | What it shows the analyst |
|---|---|
| Firewall logs | Allowed and denied connections, many denies from one source |
| IDS or IPS alerts | Signature or anomaly matches, such as a port scan or exploit attempt |
| NetFlow or IPFIX | Who talked to whom, how much and when, useful for volume spikes |
| Router and switch logs | Configuration changes, logins to devices, interface flaps |
| DNS logs | Lookups to known bad domains, unusual query volumes |
| Packet capture | Full content for deep analysis |
Responding to scanning and reconnaissance
A single host hitting many ports, or many hosts on one port, in a short time is a scan. Confirm the source is not an approved vulnerability scanner, then block the source at the perimeter firewall or IPS if it is external.
An internal scanner is more serious, because it suggests a compromised host is mapping the network. Treat that host as a likely incident and isolate it.
Responding to DoS and DDoS
| Step | Action |
|---|---|
| Identify | Confirm a traffic spike, its type (volumetric, protocol, application) and the target |
| Contain | Rate limit, filter the attack traffic, enable SYN flood protection, block sources at the edge |
| Escalate | Contact the ISP or a DDoS scrubbing service for volumetric floods the link cannot absorb |
| Recover | Restore normal routing and service once traffic falls, keep watching for a second wave |
| Learn | Add capacity, a content delivery network or permanent DDoS protection |
A single blocked IP rarely stops a DDoS, because the traffic comes from many sources. Upstream filtering is the usual answer for floods that saturate the link.
Responding to unauthorized access and device compromise
If a router, switch or firewall shows logins from an unknown address or unapproved changes, the analyst preserves the device logs and running configuration first. The team then restricts management access, resets credentials, and compares the configuration with the approved baseline.
Containment options include ACLs that block the attacker, moving the host to a quarantine VLAN, and disabling a switch port. Eradication means removing rogue configuration, patching the device and closing the exposed management service.
Responding to spoofing and man in the middle
ARP spoofing shows up as one MAC address claiming many IP addresses, or the gateway's MAC changing. Isolate the offending port and enable dynamic ARP inspection and DHCP snooping on switches.
DNS poisoning shows up as wrong answers for known names. Flush the affected caches, correct the records, and consider DNSSEC validation.
Rogue access points are found by wireless scans and wireless IDS. Locate and remove the device, then enforce port security and 802.1X.
Network containment toolkit
| Control | Use |
|---|---|
| Firewall or ACL rule | Block a malicious IP, port or protocol |
| IPS in prevention mode | Drop known attack traffic inline |
| Quarantine VLAN or NAC | Cut a suspect host off from the rest of the network |
| DNS sinkhole | Send lookups for a malicious domain to a safe address |
| Port shutdown | Stop a rogue device on a switch port |
| Upstream filtering | ISP or scrubbing service removes flood traffic |
A worked example
At 09:10 the web site slows down and NetFlow shows a tenfold rise in inbound UDP traffic from thousands of addresses. The Tier I analyst confirms it is not a marketing event and escalates it as a volumetric DDoS.
The responder applies rate limits, asks the ISP to filter upstream and switches traffic through the DDoS protection provider. When traffic normalizes the team keeps monitoring, then records the attack pattern for future detection.
How the exam asks about this
- "A firewall log shows one internal workstation connecting to port 445 on every host in the subnet. What should the analyst do first?" → Treat the workstation as compromised and isolate it.
- "Which control redirects lookups for a known malicious domain to a safe address?" → A DNS sinkhole.
- "A volumetric DDoS saturates the internet link. Who is best placed to filter the traffic?" → The ISP or a DDoS scrubbing service upstream.
What to remember for the exam
- Firewall, IDS/IPS, NetFlow, DNS and device logs are the main network evidence.
- Internal scanning usually means an internal host is already compromised.
- DDoS containment is rate limiting and upstream filtering, not blocking single IPs.
- Preserve device logs and configuration before changing a compromised router or firewall.
- Quarantine VLANs, NAC, ACLs and sinkholes are the standard containment tools.
Rebooting a compromised network device can wipe its running configuration and memory evidence. Save logs and the running configuration first.
Common mistakes
Blocking one address during a DDoS. The attack comes from many sources, so rate limiting and upstream filtering work far better.
Ignoring internal scans. An internal host mapping the network is often the first sign of lateral movement.
Fixing the device without evidence. Changing configuration before capturing it destroys the record of what the attacker did.
Check yourself
What does one MAC address claiming the default gateway's IP suggest?
ARP spoofing, a man in the middle attack, so the port should be isolated and switch protections enabled.
Why is an internal port scan more worrying than an external one?
It suggests an internal host is already compromised and mapping the network for lateral movement.
Which data source best shows a sudden rise in traffic volume between hosts?
NetFlow or IPFIX, which records who talked to whom and how much.
Topic 2 of 6 in Incident Response
Test yourself on Incident Response
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.