3.4 Identify Type of Evidence Used Based on Provided Logs 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is investigating a possible brute-force attack on a server. The logs show multiple failed logon attempts from the same IP address over a short period. Which type of evidence do the failed logon attempts provide?

   • ACorroborative evidence that the attack succeeded
   • BIndirect evidence that a brute-force attack may be occurring
   • CNo evidence because failed logons are normal
   • DBest evidence that the attack succeeded
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is investigating a possible insider threat. Logs show: (1) a user accessed a sensitive file at 15:00, (2) the user printed a document at 15:05, and (3) the user's badge was used to enter the building at 15:10. Which log provides the strongest indirect evidence that the user copied the file's contents?

   • AThe file access log at 15:00
   • BA screenshot of the user's screen showing the file open
   • CThe badge entry at 15:10
   • DThe print log at 15:05
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is investigating a data breach. Logs show: (1) a successful login from an unusual IP at 02:00, (2) a large data transfer via SFTP at 02:30, and (3) the user's account was disabled at 03:00. The user claims they were asleep. Which log provides the strongest indirect evidence that the account was compromised?

   • AThe account being disabled at 03:00
   • BThe successful login from the unusual IP
   • CThe large SFTP transfer
   • DThe user's claim that they were asleep
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is building a case that a user installed unauthorized software. The best evidence is a Windows Setup log showing the software installation at 10:00. Which additional log would provide CORROBORATIVE evidence?

   • AA firewall log showing outbound traffic at 10:05
   • BA Sysmon event 1 showing the installer process executed at 10:00
   • CAn application log from the software vendor showing a license check at 10:10
   • DA Security event showing the user logged in at 09:55
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing logs to determine whether a specific file was deleted from a server. Which log provides the best evidence of the deletion?

   • AWindows Security Event ID 4663 (object access) showing DELETE for the file
   • BA file integrity monitoring alert showing the file hash changed
   • CAn application log entry stating 'file not found'
   • DA user's email saying they deleted the file
   Reveal Solution Discussion Select an answer first