Network Forensics, Logging, and Event Management GCED Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is reviewing a packet capture from a compromised host. The capture shows a series of TCP connections from the host to an external IP address on port 445, each lasting only a few seconds and transferring small amounts of data. The analyst also notices that the destination IP is not in any threat intelligence feeds. What is the most likely explanation for this traffic pattern?

   • AThe host is performing a port scan of the external IP.
   • BThe host is downloading a large file from the external IP.
   • CThe host is beaconing to a command-and-control server.
   • DThe host is sending spam email through the external IP.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization's SIEM generates an alert for a single failed login on a domain controller. The security team is overwhelmed with such alerts and wants to reduce false positives while still detecting brute-force attacks. Which of the following is the most effective way to achieve this?

   • AIncrease the log retention period for failed login events.
   • BConfigure the SIEM to only collect logs from the domain controller.
   • CDisable the alert for failed logins entirely.
   • DCreate a correlation rule that triggers an alert only when multiple failed logins occur from the same source IP within a short time window.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is deploying a SIEM and has a limited budget. They need to decide between two options: a commercial SIEM with advanced correlation and a low-cost open-source SIEM. The company has a small security team with limited expertise. Which of the following is the most important factor in the decision?

   • AThe SIEM's ability to generate reports for compliance.
   • BThe number of log sources the SIEM can ingest.
   • CThe total cost of ownership, including the time and expertise required to maintain and tune the SIEM.
   • DThe vendor's marketing materials and brand reputation.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo ensure that evidence is stored in a secure location with limited access
   • BTo encrypt the evidence so that only authorized investigators can access it
   • CTo prove that the evidence has not been tampered with and to document its handling from collection to presentation
   • DTo delete evidence that is not relevant to the investigation
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is investigating a malware infection and has a packet capture. The capture shows the infected host making HTTP requests to a known malicious domain, but the requests are encrypted with TLS. The analyst also has proxy logs that show the full URL of the requests. Which source provides the most useful information for identifying the malware's C2 behavior?

   • ANeither source is useful because the traffic is encrypted.
   • BThe proxy logs, because they show the full URL and may include additional metadata.
   • CThe packet capture, because it shows the raw network traffic.
   • DBoth sources are equally useful.
   Reveal Solution Discussion Select an answer first