3.4 Identify Type of Evidence Used Based on Provided Logs 200-201 Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   An analyst has best evidence from a process creation log that a malicious script ran. Which additional log would provide corroborative evidence that the script was launched by a scheduled task?

   • AWindows Task Scheduler operational log showing the task triggered at the same time
   • BA firewall log showing outbound connections
   • CA user's email saying they ran the script manually
   • DA DNS log showing a query for a malicious domain
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst sees a single failed login event for a user at 03:00, followed by a successful login at 03:01 from a different country. No other logs exist. Which type of evidence does the successful login represent?

   • AIndirect evidence that the account may be compromised
   • BCorroborative evidence that the failed login was a brute force
   • CBest evidence that the account was compromised
   • DDirect evidence that the user changed their password
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst has best evidence that a user accessed a confidential document: a Security event 4663 showing READ access. Which additional log would provide CORROBORATIVE evidence?

   • AA Sysmon event 11 showing the document was created
   • BA logon event showing the user logged in at the time of access
   • CA network log showing the user's workstation communicated with the file server
   • DA file system audit log showing the document was opened by the user's process
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is investigating whether a user accessed a confidential file. Which log entry is the BEST evidence that the user accessed the file?

   • AA network log showing the user's workstation communicated with the file server
   • BA logon event showing the user logged in at the time of access
   • CA Windows Security event 4663 showing the user opened the file with READ access
   • DA Sysmon event 11 showing the file was created
   Reveal Solution Discussion Select an answer first