An analyst is normalizing logs from different sources into a common format. Which step is essential to ensure that timestamps from different time zones can be compared accurately?

Sorting logs alphabetically by source IP

Removing timestamps that appear inconsistent

Keeping each log in its original time zone

Converting all timestamps to a single standard time zone, such as UTC

An analyst has confirmed that a server communicated with a known malicious IP. The analyst must document this IoC for the incident response team, but the organization requires that all reports be concise and actionable. Which documentation approach best meets this requirement?

Provide only the threat feed report

Provide a structured summary with the key fields (timestamp, source/destination IPs, ports, protocol) and the threat feed reference

Attach the full raw firewall log file

Write a narrative paragraph describing the event without specific fields

A network log shows a connection to the IP address 198.51.100.7. A threat intelligence feed lists this IP as a known command-and-control server. What does this correlation indicate?

The log entry is a false positive

The IP address is legitimate and safe

The host may be compromised and communicating with a malicious server

EC-CouncilDigital Forensics Essentials

Domain 5Objective 3

Identifying IoCs from Network Logs DFE Practice Questions (Page 9)

Part of the Network and Web Attack Forensics domain, which makes up ~15% of our current practice bank.

48questions here

10free pages

6concepts

Questions 41–45

41foundation · easy
Which of the following IoC categories is best represented by the string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' appearing in a web proxy log?
Select an answer first
42foundation · easy
An analyst is normalizing logs from different sources into a common format. Which step is essential to ensure that timestamps from different time zones can be compared accurately?
Select an answer first
43expert · hard
An analyst has confirmed that a server communicated with a known malicious IP. The analyst must document this IoC for the incident response team, but the organization requires that all reports be concise and actionable. Which documentation approach best meets this requirement?
Select an answer first
44foundation · easy
A network log shows a connection to the IP address 198.51.100.7. A threat intelligence feed lists this IP as a known command-and-control server. What does this correlation indicate?
Select an answer first
45foundation · easy
During an investigation, an analyst needs to identify which internal host communicated with a known malicious external IP. Which network log source would most directly provide this information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Identifying IoCs from Network Logs DFE Practice Questions (Page 9)

Questions 41–45

Which of the following IoC categories is best represented by the string 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' appearing in a web proxy log?

An analyst is normalizing logs from different sources into a common format. Which step is essential to ensure that timestamps from different time zones can be compared accurately?

An analyst has confirmed that a server communicated with a known malicious IP. The analyst must document this IoC for the incident response team, but the organization requires that all reports be concise and actionable. Which documentation approach best meets this requirement?

A network log shows a connection to the IP address 198.51.100.7. A threat intelligence feed lists this IP as a known command-and-control server. What does this correlation indicate?

During an investigation, an analyst needs to identify which internal host communicated with a known malicious external IP. Which network log source would most directly provide this information?

Keep studying — Network and Web Attack Forensics