1.10 Interpret the 5-Tuple Approach to Isolate a Compromised Host in a Grouped Set of Logs 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst is examining logs grouped by 5-tuple and notices a single host communicating with an external IP on port 4444 using TCP. The traffic is periodic and low-volume. What should the analyst suspect?

   • AA command-and-control channel
   • BA DNS query
   • CNormal web browsing
   • DAn email transfer
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC analyst is investigating a host that is suspected of data exfiltration. The logs show the host communicating with an external IP on port 443 using TCP, but the traffic volume is very high and occurs at odd hours. The analyst also notices that the host is making DNS queries to a domain that is not in the corporate allowlist. Which 5-tuple pattern is most indicative of data exfiltration?

   • ABoth the high volume of HTTPS traffic and the DNS queries to a non-allowlisted domain
   • BDNS queries to a non-allowlisted domain
   • CThe host using a source port above 1024
   • DHigh volume of TCP traffic to a single external IP on port 443
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A network administrator is analyzing proxy logs to identify all web traffic from a specific user's workstation. The workstation has a dynamic IP address assigned via DHCP. Which additional information is needed to accurately group the logs by the workstation's 5-tuple?

   • AThe default gateway of the workstation.
   • BThe hostname of the workstation.
   • CThe time range during which the workstation had a specific IP address.
   • DThe MAC address of the workstation.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC is investigating a host that is suspected of being compromised. The logs show the following 5-tuples for the host: (10.0.0.5, 8.8.8.8, 12345, 53, UDP), (10.0.0.5, 8.8.8.8, 12346, 53, UDP), (10.0.0.5, 8.8.8.8, 12347, 53, UDP), and (10.0.0.5, 8.8.8.8, 12348, 53, UDP). The analyst also sees a single TCP connection to 203.0.113.5 on port 4444. Which conclusion is most supported by the 5-tuple analysis?

   • AThe host is performing a port scan against 8.8.8.8.
   • BThe host is making normal DNS queries and a legitimate connection to a server.
   • CThe host is infected with malware that is using UDP for C2.
   • DThe host is using DNS tunneling to exfiltrate data.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is reviewing firewall logs and sees a large number of entries with the same source IP and destination IP but different destination ports. The analyst suspects a port scan. Which 5-tuple field is most useful to confirm this pattern?

   • ASource port
   • BProtocol
   • CDestination port
   • DDestination IP
   Reveal Solution Discussion Select an answer first