Network and Log Investigations GCIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A firewall log shows a large volume of outbound DNS queries from an internal server to a single external IP, with each query using a unique subdomain such as 'abc123.malicious-domain.com'. The server is not a DNS resolver. What does this pattern most likely indicate?

   • ADNS tunneling for data exfiltration or command-and-control communication.
   • BA misconfigured DNS resolver that is forwarding queries to an external server.
   • CA distributed denial-of-service attack using DNS amplification.
   • DNormal DNS caching behavior for a web server.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are building a timeline of an incident. The pcap shows an ARP scan at 10:00:00, followed by an SMB connection to a file server at 10:05:00, and then an HTTP POST to an external site at 10:10:00. What is the most likely sequence of attacker actions?

   • ALateral movement (SMB), reconnaissance (ARP scan), data exfiltration (HTTP POST).
   • BReconnaissance (ARP scan), data exfiltration (HTTP POST), lateral movement (SMB).
   • CData exfiltration (HTTP POST), lateral movement (SMB), reconnaissance (ARP scan).
   • DReconnaissance (ARP scan), lateral movement (SMB), data exfiltration (HTTP POST).
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which section is typically included in an incident report to provide a high-level overview for management?

   • AFull log dumps
   • BMalware source code
   • CExecutive summary
   • DRaw packet capture data
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An incident responder is collecting log files from a compromised server as evidence. Which action is most important to maintain the integrity of the evidence?

   • AOpen the files in a text editor
   • BCalculate a cryptographic hash of the original files
   • CCopy the files to a USB drive
   • DDelete the original files after copying
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An analyst is correlating authentication logs from a domain controller and a VPN gateway. The VPN log shows a successful login from a remote IP at 02:00, and the domain controller log shows a successful login for the same user from the same IP at 02:05. What does this correlation indicate?

   • AThe user's account is compromised
   • BThe user connected via VPN and then authenticated to the domain
   • CThe VPN and domain controller are on different networks
   • DThe user is performing lateral movement
   Reveal Solution Discussion Select an answer first