Event Correlation Concepts and Techniques DFE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which correlation technique relies on predefined patterns or signatures to identify known attack sequences?

   • AStatistical correlation
   • BManual correlation
   • CRule-based correlation
   • DMachine learning correlation
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic analyst is investigating a web server breach. The server logs show a single failed login attempt from an internal IP at 02:14:03, and the firewall logs show an outbound connection from that same IP to a known command-and-control domain at 02:14:05. The analyst wants to establish a causal link between these two events. Which action best applies event correlation to support the investigation?

   • ASearch the firewall logs for other outbound connections to the same domain from different internal IPs.
   • BCompare the timestamps and source IPs across the two log sources to build a timeline of the attack sequence.
   • CIsolate the failed login event and analyze it independently to determine if it was a brute-force attempt.
   • DCheck the web server's access log for the same IP to see if any files were downloaded before the failed login.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which sequence correctly represents the typical steps in the event correlation process?

   • AAnalysis → Data collection → Normalization
   • BData collection → Analysis → Normalization
   • CNormalization → Data collection → Analysis
   • DData collection → Normalization → Analysis
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An incident responder is correlating events from multiple servers to investigate a suspected web attack. The responder notices that the timestamps in the web server logs are 30 minutes ahead of the firewall logs, even though both are supposed to be in UTC. What is the most likely cause of this discrepancy, and what should the responder do to ensure accurate correlation?

   • AThe firewall logs are incomplete; the responder should collect additional logs from the firewall.
   • BThe firewall logs are in a different time zone; the responder should convert them to the web server's time zone.
   • CThe web server logs are encrypted; the responder needs to decrypt them before comparing timestamps.
   • DThe web server's clock is not synchronized; the responder should use NTP to synchronize all systems and note the offset in the investigation.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   During an investigation, an analyst collects logs from a web server, a database server, and a firewall. The logs use different formats: some are in JSON, some in CSV, and some in syslog. Before correlating the events, what is the most important step the analyst should perform?

   • AStore the logs in separate folders to avoid mixing formats.
   • BNormalize the logs into a common format so that fields like timestamps and IP addresses can be compared consistently.
   • CDelete logs that are not in the same format as the majority.
   • DConvert all logs to PDF for easier reading.
   Reveal Solution Discussion Select an answer first