The SOC has noticed an unusual volume of traffic comingfrom an open wi-fi guest Network that appears correlated with aborder Network slow down. The network team is unable to capturetraffic, but logs from Network Services are available.
No users have authenticated recently there was a guestnetworks captive portal
DDoS mitigation systems are not alerting
DNS resolver logs show some very long domainnames
Which of the following is the best step for securityanalysis to take next?
Block all outbound traffic from the guest Network at theborder firewall
verify the passphrase on the guest network has not beenchanged
search antivirus logs for evidence of compromise companydevice
review access point logs to identify potential a zombieservices
