1.10 Interpret the 5-Tuple Approach to Isolate a Compromised Host in a Grouped Set of Logs 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which field combination should be used to group logs to see all traffic between a specific client and server?

   • ASource IP and destination IP
   • BSource IP, destination IP, source port, destination port, and protocol
   • CSource MAC and destination MAC
   • DSource port and destination port
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is examining a grouped set of logs for a single host. The logs show the following 5-tuples: (10.0.0.5, 8.8.8.8, 12345, 53, UDP), (10.0.0.5, 8.8.8.8, 12346, 53, UDP), (10.0.0.5, 8.8.8.8, 12347, 53, UDP), and (10.0.0.5, 8.8.8.8, 12348, 53, UDP). Which pattern should the analyst recognize as suspicious?

   • AThe host is using a well-known DNS server, which is normal behavior.
   • BThe host is using UDP instead of TCP, which is a sign of compromise.
   • CThe host is performing a port scan against the DNS server.
   • DThe host is generating a large number of DNS queries with different source ports, which could indicate DNS tunneling or a compromised host.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A SOC analyst is investigating a host that is suspected of being compromised. The logs show the following 5-tuples: (10.0.0.5, 192.168.1.1, 12345, 22, TCP), (10.0.0.5, 192.168.1.1, 12346, 22, TCP), (10.0.0.5, 192.168.1.1, 12347, 22, TCP), (10.0.0.5, 192.168.1.1, 12348, 22, TCP). The analyst also sees a single connection to 203.0.113.5 on port 4444. Which conclusion is most supported?

   • AThe host is infected with malware that is using SSH for C2.
   • BThe host is using SSH tunneling to exfiltrate data.
   • CThe host is making normal SSH connections and a legitimate connection to a server.
   • DThe host is performing a brute-force attack against the SSH server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOC analyst needs to identify all traffic from a compromised host to any destination on port 53. Which 5-tuple filter should be applied?

   • Aprotocol = UDP AND destination port = 53
   • Bsource IP = compromised_host AND destination port = 53
   • Cdestination IP = compromised_host AND destination port = 53
   • Dsource port = 53 AND destination IP = compromised_host
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident responder is investigating a compromised host that communicates using both IPv4 and IPv6. The firewall logs contain both IPv4 and IPv6 entries. Which approach is necessary to isolate all traffic from the host?

   • AFilter using the host's MAC address.
   • BFilter only the IPv6 traffic using the host's IPv6 address.
   • CFilter only the IPv4 traffic using the host's IPv4 address.
   • DFilter using both the host's IPv4 and IPv6 addresses in the source or destination fields.
   Reveal Solution Discussion Select an answer first