1.10 Interpret the 5-Tuple Approach to Isolate a Compromised Host in a Grouped Set of Logs 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is investigating a suspected data exfiltration from a single server. The analyst has access to a large set of NetFlow records. Which grouping of the records would best reveal all communication sessions involving that server?

   • AGroup by source IP and destination IP only.
   • BGroup by destination port only.
   • CGroup by the full 5-tuple of each session.
   • DGroup by protocol only.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   While reviewing logs grouped by the 5-tuple, an analyst notices a large number of flows from a single host to many different destination ports on the same IP. Which pattern does this suggest?

   • AA port scan
   • BNormal web browsing
   • CA file transfer
   • DA DNS query
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An analyst groups logs by the 5-tuple and sees a series of flows from a single host to the same destination IP and port, occurring at regular intervals. What does this pattern most likely indicate?

   • AA one-time file download
   • BA beaconing communication
   • CA DNS cache poisoning attempt
   • DA broadcast storm
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An incident responder needs to isolate all traffic from a compromised host that has a dynamic IP address. The host's IP changed twice during the incident window. The responder has DHCP logs and firewall logs. Which approach is most effective?

   • AFilter firewall logs using the current IP address of the host.
   • BCorrelate DHCP logs to determine the time ranges for each IP, then filter firewall logs for each IP during its respective time range.
   • CFilter firewall logs using the original IP address of the host.
   • DFilter firewall logs using the host's MAC address.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A SOC analyst is reviewing logs grouped by 5-tuple for a single host. The analyst notices the following entries: (10.0.0.5, 192.168.1.1, 12345, 22, TCP), (10.0.0.5, 192.168.1.1, 12346, 22, TCP), (10.0.0.5, 192.168.1.1, 12347, 22, TCP), (10.0.0.5, 192.168.1.1, 12348, 22, TCP). What does this pattern indicate?

   • AThe host is downloading a large file over HTTP.
   • BThe host is performing a port scan against the internal server.
   • CThe host is establishing multiple SSH connections to the same server using different source ports.
   • DThe host is sending DNS queries to the internal server.
   Reveal Solution Discussion Select an answer first