A network administrator is investigating a possible brute-force attack against an internal server. Which log source would provide the most direct evidence of repeated failed login attempts from multiple external IPs?

Authentication logs on the server

An analyst is correlating proxy logs with a threat intelligence feed that lists malicious domains. The proxy logs contain URLs, but the feed uses domain names. What is the most efficient way to match them?

Compare the full URL string to the feed

Extract the domain from each URL and compare it to the feed

Hash the URL and compare to a hash feed

Use the IP address of the proxy server

An analyst has confirmed that a workstation communicated with a known malicious IP. The analyst must produce a report for management that includes the evidence. Which reporting approach is most appropriate?

Include the raw log excerpt with timestamps, source/destination IPs, and the threat feed match

Summarize the finding in one sentence without technical details

Provide only the threat feed report

List all outbound connections from the workstation for the past month

EC-CouncilDigital Forensics Essentials

Domain 5Objective 3

Identifying IoCs from Network Logs DFE Practice Questions (Page 7)

Part of the Network and Web Attack Forensics domain, which makes up ~15% of our current practice bank.

48questions here

10free pages

6concepts

Questions 31–35

31foundation · easy
A forensic analyst is reviewing network logs to find indicators of compromise. Which log source is most likely to contain records of allowed and denied traffic based on security policy rules?
Select an answer first
32application · medium
A network administrator observes a server that normally sends 2 MB of data per day suddenly transmitting 500 MB of data to an external IP address over SSH during off-hours. Which type of indicator does this behavior most directly represent?
Select an answer first
33application · medium
A network administrator is investigating a possible brute-force attack against an internal server. Which log source would provide the most direct evidence of repeated failed login attempts from multiple external IPs?
Select an answer first
34application · medium
An analyst is correlating proxy logs with a threat intelligence feed that lists malicious domains. The proxy logs contain URLs, but the feed uses domain names. What is the most efficient way to match them?
Select an answer first
35application · medium
An analyst has confirmed that a workstation communicated with a known malicious IP. The analyst must produce a report for management that includes the evidence. Which reporting approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Identifying IoCs from Network Logs DFE Practice Questions (Page 7)

Questions 31–35

A forensic analyst is reviewing network logs to find indicators of compromise. Which log source is most likely to contain records of allowed and denied traffic based on security policy rules?

A network administrator observes a server that normally sends 2 MB of data per day suddenly transmitting 500 MB of data to an external IP address over SSH during off-hours. Which type of indicator does this behavior most directly represent?

A network administrator is investigating a possible brute-force attack against an internal server. Which log source would provide the most direct evidence of repeated failed login attempts from multiple external IPs?

An analyst is correlating proxy logs with a threat intelligence feed that lists malicious domains. The proxy logs contain URLs, but the feed uses domain names. What is the most efficient way to match them?

An analyst has confirmed that a workstation communicated with a known malicious IP. The analyst must produce a report for management that includes the evidence. Which reporting approach is most appropriate?

Keep studying — Network and Web Attack Forensics