Which of the following data source will a SOC Analyst use to monitor connections to the insecure ports?

Netstat (network statistics) is a command-line utility that displays active TCP connections, ports on which the computer is listening, Ethernet statistics, and the IP routing table. A SOC analyst would use data from Netstat or equivalent host-based network monitoring tools (like logs from an EDR agent that capture this information) to see exactly which ports are open and listening for connections on a system. This data source directly reveals established connections to any port, including those deemed insecure, making it the most appropriate tool for this specific monitoring task.

B. DNS Data: DNS logs show domain name resolution requests and responses. They do not provide information about specific port connections on a host.
C. IIS Data: These are application-level logs from Microsoft's web server, which detail HTTP/S requests, typically on ports 80/443, not all network connections.
D. DHCP Data: DHCP logs track the assignment of IP addresses to devices on a network. They contain no information about port-level network connections.

1. Microsoft. (2021, September 15). netstat. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat. The official documentation describes its function to display "active TCP connections" and "ports on which the computer is listening."

2. Barrett, D. J., & Silverman, R. E. (2018). Linux Security Cookbook (2nd ed.). O'Reilly Media. Chapter 4, "Network Security," Section 4.1, "Finding Listening Network Ports," pp. 113-115, details using netstat and ss for this exact purpose.