Identifying IoCs from Network Logs DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An analyst has a list of internal IPs that contacted an external IP flagged by a threat intelligence feed. The analyst wants to confirm the communication and identify the specific protocol and port used. Which log source would provide the most reliable confirmation?

   • AEndpoint antivirus logs
   • BDNS logs
   • CFirewall session logs
   • DAuthentication logs
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   When documenting an IoC for a forensic report, which of the following is the most essential information to include?

   • AThe name of the analyst's supervisor
   • BThe color of the server rack
   • CThe brand of the firewall
   • DThe specific indicator value and the timestamp it was observed
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst notices a workstation sending HTTP requests with an unusual User-Agent string that matches a known malware signature. Which category of IoC does this represent?

   • AMalicious domain
   • BMalicious user agent
   • CMalicious IP
   • DAnomalous traffic pattern
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security analyst notices a workstation repeatedly connecting to a known-bad IP address on TCP port 4444. Which network log source would provide the most direct evidence of these repeated outbound connections, including source and destination IPs and ports?

   • AFirewall connection log
   • BDHCP lease log
   • CDNS query log
   • DWeb proxy access log
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An analyst has a list of internal IPs that communicated with a known malicious IP. The analyst wants to determine which internal hosts were affected and when. Which approach is most effective?

   • ASearch DHCP logs for the malicious IP
   • BSearch firewall logs for connections to the malicious IP and extract source IPs and timestamps
   • CSearch web proxy logs for the malicious IP in the URL
   • DSearch DNS logs for queries to the malicious IP
   Reveal Solution Discussion Select an answer first