4.1 Map the Provided Events to Source Technologies 200-201 Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which log entry is most characteristic of a firewall?

   • APacket with TCP flags SYN-ACK from 10.0.0.1:443 to 192.168.1.5:5555 was dropped by rule 45
   • BAlert: ET SCAN Potential SSH Scan from 10.0.0.1 to 192.168.1.0/24
   • CUser 'jsmith' requested https://www.example.com and was allowed by policy
   • DMalware 'Trojan.Downloader' detected in file 'setup.exe'
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is investigating a long-running connection between an internal host and an external IP. The log shows: `src=10.1.1.5, dst=198.51.100.23, sport=12345, dport=4444, proto=tcp, packets=10000, bytes=8000000, first_seen=..., last_seen=...`. Which source technology is the most likely origin of this log?

   • AAntivirus
   • BProxy
   • CNetFlow
   • DIDS
   Reveal Solution Discussion Select an answer first