Identifying IoCs from Network Logs DFE Practice Questions (Page 10)

Questions 46–48

1. 46application · medium

   A security team uses a threat intelligence feed that lists malicious domains. An analyst wants to identify any internal hosts that have resolved these domains. Which log source would be most effective for this correlation?

   • ADHCP logs
   • BFirewall logs
   • CIDS logs
   • DDNS logs
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   An analyst is correlating logs from multiple sources (firewall, proxy, DNS) with a threat intelligence feed. The firewall logs use epoch time, the proxy logs use local time, and the DNS logs use UTC. The analyst must produce a unified timeline of events. Which normalization step is most critical to perform first?

   • ASort the logs by source IP address
   • BRemove all log entries that do not match the threat feed
   • CConvert all timestamps to a single timezone (UTC) and a consistent format
   • DConvert all IP addresses to domain names
   Reveal Solution Discussion Select an answer first
3. 48expert · hard

   An organization has both an IDS and a firewall. The IDS logs show a suspicious outbound connection from an internal host to a known malicious IP, but the firewall logs show the connection was blocked. The analyst must determine whether the host was actually compromised. Which conclusion is most appropriate?

   • AThe IDS logs are false positives because the firewall blocked the connection
   • BThe firewall logs are incorrect because the IDS detected the connection
   • CThe host is definitely compromised because it attempted to connect to a malicious IP
   • DThe connection was blocked, so the host may not have been compromised, but the attempt itself warrants investigation
   Reveal Solution Discussion Select an answer first