Identifying IoCs from Network Logs DFE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst has a raw firewall log line: 'src=192.168.1.10 dst=203.0.113.5 sport=49152 dport=443 proto=tcp action=allow'. The analyst needs to compare this with a threat feed that lists IP addresses. Which extracted field is the direct match for the feed?

   • Aaction=allow
   • Bsrc=192.168.1.10
   • Cdst=203.0.113.5
   • Ddport=443
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization suspects that an internal user is visiting phishing websites. Which combination of log sources would provide the most complete evidence of the user's browsing activity and the associated network connections?

   • AIDS logs and router logs
   • BProxy logs and DNS logs
   • CDNS logs and DHCP logs
   • DFirewall logs and DHCP logs
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A raw network log entry contains the string 'src=192.168.1.10 dst=10.0.0.5 sport=12345 dport=80 proto=tcp'. After normalizing this log, which field would be extracted as the destination port?

   • A12345
   • Btcp
   • C80
   • D192.168.1.10
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is correlating proxy logs with a threat intelligence feed. The feed contains both IP addresses and domains, but the proxy logs only contain the requested URL and the client IP. The analyst must identify internal hosts that accessed known malicious content. Which approach is most effective?

   • AExtract the hostname from the URL and match it against the domain list; also resolve the hostname to an IP and match against the IP list
   • BMatch the full URL string against the domain list
   • CUse only the IP list and ignore the domain list
   • DMatch only the client IP against the IP list
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is correlating firewall logs with a threat intelligence feed that lists IP addresses. The firewall logs show a connection to an IP that is one octet different from an IP in the feed (e.g., 203.0.113.5 vs 203.0.113.6). The analyst must decide whether to flag this as a match. Which action is most appropriate?

   • AIgnore the connection entirely because it is not an exact match
   • BFlag it as a match because the IPs are similar
   • CFlag it as a match only if the port is the same
   • DDo not flag it as a match, but note the similarity for further investigation
   Reveal Solution Discussion Select an answer first