3.4 Identify Type of Evidence Used Based on Provided Logs 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst must determine whether a specific USB device was connected to a Windows host. Which log provides the best evidence?

   • AA file system log showing files copied to the host
   • BA security log showing a logon event
   • CWindows Setup log (setupapi.dev.log) showing the device installation
   • DA user's chat message saying they plugged in a USB drive
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An analyst has already identified a log entry that directly shows a user downloaded a malicious file. Which additional log entry would provide CORROBORATIVE evidence that the download actually occurred?

   • AA web proxy log showing the same user's IP address requested the URL of the malicious file at the same time
   • BA system log showing that the user logged in to the host that day
   • CA DNS log showing that the user's host resolved the domain of the malicious file's URL
   • DAn antivirus log showing that the malicious file was quarantined on a different host
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst has best evidence that a user's account was used to send a malicious email. Which additional log would provide the strongest corroborative evidence that the account was compromised rather than the user being the sender?

   • AA successful login from a foreign IP address just before the email was sent
   • BA firewall log showing outbound SMTP traffic
   • CThe email server log showing the message was sent from the user's mailbox
   • DA user's phone bill showing they were on a call at the time
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is investigating a suspected data exfiltration. The logs show: (1) an HTTP POST to a file-sharing site from the user's workstation at 14:32:05, (2) a firewall log entry permitting that connection, (3) a proxy log entry showing the same URL and timestamp, and (4) a user's email stating 'I uploaded the file as requested.' Which log should be cited as the best evidence that the file was actually transmitted?

   • AThe firewall log entry permitting the connection
   • BThe user's email stating 'I uploaded the file as requested'
   • CThe HTTP POST entry from the workstation's web server log
   • DThe proxy log entry showing the same URL
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a phishing email that led to credential theft. The analyst has best evidence (a process creation log) that a malicious script ran. Which additional log would provide the strongest corroborative evidence that the script was delivered via the phishing email?

   • AA DNS log showing a query for the phishing domain
   • BA firewall log showing a connection to the attacker's server
   • CEmail gateway log showing the attachment was delivered to the user's inbox
   • DA user's statement that they clicked the link
   Reveal Solution Discussion Select an answer first