Identifying IoCs from Network Logs DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst is correlating network logs with a threat intelligence feed. What is the primary purpose of this correlation?

   • ATo reduce the size of the log files
   • BTo encrypt the log data
   • CTo replace the need for antivirus software
   • DTo identify known malicious indicators in the logs
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst has identified multiple IoCs from different log sources and needs to document them for a formal forensic report. The report will be reviewed by both technical and non-technical stakeholders. Which approach best balances clarity and technical detail?

   • AProvide only a high-level executive summary
   • BProvide a summary table of IoCs with a brief technical explanation of each
   • CProvide a detailed narrative of the investigation without tables
   • DProvide only the raw log excerpts
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is reviewing firewall logs and notices a server making outbound connections to multiple external IPs on port 53 using TCP, with each connection transferring a small amount of data. The analyst suspects DNS tunneling. Which additional log source would provide the most direct confirmation?

   • ADNS server logs showing the actual queries
   • BNetFlow logs
   • CDHCP logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization's firewall logs show a workstation making outbound connections to a known malicious IP on port 443. However, the organization's proxy logs show no corresponding HTTPS requests from that workstation. The analyst must determine whether the workstation is truly compromised. Which conclusion is most appropriate?

   • AThe workstation is definitely compromised because it connected to a known malicious IP
   • BThe workstation may be using a non-proxied application or protocol, so the connection is still suspicious and warrants further investigation
   • CThe firewall logs are incorrect because proxy logs are more reliable
   • DThe connection is a false positive because the proxy logs show no matching request
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network administrator notices that a database server, which normally communicates only with internal application servers, is sending large amounts of data to an external IP address on port 443 during business hours. Which indicator is most directly suggested by this observation?

   • AMalicious user agent
   • BData exfiltration pattern
   • CKnown malicious domain
   • DProtocol misuse
   Reveal Solution Discussion Select an answer first