1.10 Interpret the 5-Tuple Approach to Isolate a Compromised Host in a Grouped Set of Logs 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is reviewing logs from a network that uses a load balancer. The analyst is trying to isolate traffic from a specific internal host. Which challenge does the analyst face when using the 5-tuple?

   • AThe source port will always be the same for all internal hosts, making it impossible to distinguish them.
   • BThe source IP in the logs will be the load balancer's IP, not the internal host's IP.
   • CThe destination IP will be the internal host's IP, which is not visible in the logs.
   • DThe protocol will be changed by the load balancer, making it impossible to identify the traffic.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident responder needs to isolate all traffic from a compromised host that is behind a NAT gateway. The host's private IP is known, but the firewall logs show only the public IP of the NAT gateway. Which additional information is needed to accurately isolate the host's traffic?

   • AThe MAC address of the compromised host.
   • BThe NAT translation table or session logs that map private IPs to public IPs and ports.
   • CThe default gateway of the compromised host.
   • DThe hostname of the compromised host.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   A network analyst is reviewing a packet capture to document the communication session between a workstation and a web server. The analyst records the workstation's IP address (192.168.10.25), the web server's IP address (203.0.113.10), the workstation's ephemeral port (49152), the web server's port (443), and the transport protocol (TCP). Which of the following best describes what the analyst has documented?

   • AA 5-tuple that uniquely identifies the communication session between the two hosts
   • BA socket pair that identifies only the application-layer protocol in use
   • CA network flow record that includes the MAC addresses of both endpoints
   • DA session identifier that includes the DNS names of both communicating hosts
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is reviewing logs from a network that uses NAT. The analyst is trying to isolate traffic from a specific internal host behind the NAT. Which challenge does the analyst face when using the 5-tuple?

   • AThe source IP in the logs will be the NAT device's IP, not the internal host's IP.
   • BThe source port will always be the same for all internal hosts, making it impossible to distinguish them.
   • CThe destination IP will be the internal host's IP, which is not visible in the logs.
   • DThe protocol will be changed by NAT, making it impossible to identify the traffic.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is examining a grouped set of firewall logs for a single host. The logs show the host connecting to many different destination IP addresses on port 445 over a short period. Which conclusion is most consistent with this pattern?

   • AThe host is likely infected with malware that is spreading laterally.
   • BThe host is performing a port scan against multiple targets.
   • CThe host is downloading a large file from a single server.
   • DThe host is performing a DNS lookup for multiple domains.
   Reveal Solution Discussion Select an answer first