Network Forensics Fundamentals DFE Practice Questions (Page 11)

Questions 51–51

1. 51application · medium

   A security analyst is investigating a suspected data exfiltration from a web server. The server logs show a series of HTTP POST requests to an external IP, each with a response size of exactly 1440 bytes. The analyst needs to confirm whether the payloads contained sensitive data and reconstruct the sequence of events. Which approach should the analyst take?

   • ACheck the web server's error logs for any failed requests that might indicate the exfiltration attempt.
   • BCorrelate the server access logs with full packet captures from the network perimeter to reassemble the HTTP sessions and inspect the payloads.
   • CRun a vulnerability scanner against the external IP to determine if it is a known command-and-control server.
   • DReview only the server logs to identify the source IP addresses and timestamps of the POST requests.
   Reveal Solution Discussion Select an answer first