Identifying IoCs from Network Logs DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company suspects that an internal host is communicating with a command-and-control server using HTTPS. Which log source would provide the most useful evidence of the communication, given that the traffic is encrypted?

   • AFirewall logs
   • BProxy logs with SSL inspection enabled
   • CDNS logs
   • DNetFlow logs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A web server log contains many requests from a single IP address, each with a different User-Agent string and each requesting a unique URL path that does not exist on the server. Which category of IoC does this pattern best represent?

   • AData exfiltration
   • BAnomalous traffic pattern
   • CKnown malicious domain
   • DProtocol misuse
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A proxy log entry shows: '2024-03-15 14:22:31 10.0.0.5 GET http://malicious.example.com/update.php HTTP/1.1 200 Mozilla/5.0'. An analyst wants to correlate this entry with a threat intelligence feed that lists malicious domains. Which field must be extracted and normalized to perform the correlation?

   • AThe HTTP status code '200'
   • BThe client IP '10.0.0.5'
   • CThe URL hostname 'malicious.example.com'
   • DThe HTTP method 'GET'
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is correlating proxy logs with a threat intelligence feed. The proxy logs contain URLs, but the feed contains domains and IPs. The analyst notices that some URLs use IP addresses instead of domain names. What is the most effective way to ensure all indicators are matched?

   • AOnly extract the domain from each URL
   • BOnly extract the IP from each URL
   • CExtract both the domain and the IP from each URL and compare both to the feed
   • DCompare the full URL string to the feed
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An IDS log shows a series of outbound connections from an internal host to a remote server on port 53, but the payloads are large and contain binary data rather than typical DNS queries. Which type of IoC does this represent?

   • AKnown malicious IP
   • BProtocol misuse
   • CMalicious user agent
   • DData exfiltration pattern
   Reveal Solution Discussion Select an answer first