2.22 Describe Tools and Their Limitations for Network Analysis Such as Packet Capture Tools, Traffic Analysis Tools, Network Log Analysis Tools 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC is investigating a potential advanced persistent threat. The team has a SIEM that ingests logs from firewalls, proxies, and endpoints. The SIEM is receiving logs from a firewall that is not NTP-synchronized, and the proxy logs are missing entries for certain users due to a misconfiguration. The team needs to correlate a specific user's activity across all sources. What is the best course of action?

   • AProceed with the correlation, using the SIEM's time-adjustment features to compensate for the clock skew.
   • BFix the NTP synchronization and proxy logging configuration before proceeding with the correlation.
   • CRely on the firewall logs alone, since they are the most complete source.
   • DUse packet capture on the firewall to fill in the missing proxy logs.
   Reveal Solution Discussion Select an answer first
2. 37foundation · medium

   An analyst is using a traffic analysis tool to investigate a security incident and needs to see the actual payload of a suspicious HTTP request. Which limitation of traffic analysis tools prevents this?

   • ADifficulty with encrypted traffic
   • BLack of deep packet inspection
   • CSampling inaccuracies
   • DLog volume
   Reveal Solution Discussion Select an answer first
4. 38foundation · medium

   A SOC analyst is correlating logs from multiple devices to trace an attack. The analyst notices that events from different devices appear out of order. Which limitation of network log analysis tools is most likely causing this?

   • ATime synchronization issues
   • BSampling inaccuracies
   • CIncomplete logging
   • DLog volume
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is investigating a security incident and needs to determine whether a specific user logged into a server at a particular time. The analyst checks the log analysis platform and finds that the authentication server's logs for that time period are missing. Which limitation of network log analysis tools is most likely the cause?

   • AThe log analysis tool is sampling the logs to reduce storage.
   • BIncomplete logging on the authentication server or loss during log transport.
   • CThe log analysis tool cannot parse the authentication server's log format.
   • DThe authentication server's logs are encrypted and cannot be read.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst needs to capture traffic between two internal servers during a suspected data exfiltration event. The servers communicate over HTTPS on port 443, and the analyst has administrative access to both servers. The analyst wants to see the actual payload content exchanged. Which approach should the analyst take?

   • AConfigure a SPAN port on the switch and run tcpdump with the -s 0 option to capture full packets.
   • BUse tcpdump on one server with the -A option to print packet contents in ASCII, then inspect the output.
   • CRun Wireshark on one of the servers and use the 'Follow TCP Stream' feature on the captured HTTPS session.
   • DCapture traffic on one server with tcpdump, then import the pcap into Wireshark and provide the server's TLS private key for decryption.
   Reveal Solution Discussion Select an answer first