Network and Log Investigations GCIH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After completing a network investigation, you must write a report for both technical staff and executive management. Which approach best meets the needs of both audiences?

   • APresent only the final conclusion and recommended actions, omitting evidence.
   • BWrite a single detailed technical report with all raw logs and packet captures.
   • CProvide an executive summary with key findings and a technical appendix with detailed logs and analysis.
   • DWrite a brief summary with no technical details to avoid confusing non-technical readers.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   You are the incident handler for a company that is about to enter litigation. You need to collect network logs from a firewall that is still in production. The logs are critical to the case. What is the most appropriate approach to preserve the evidence while minimizing operational impact?

   • AEnable additional logging on the firewall to capture more data
   • BTake the firewall offline and clone the disk
   • CWait until the firewall is decommissioned to collect the logs
   • DCopy the log files to a forensic workstation and hash them, while leaving the firewall running
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   When writing an incident report, what is the most important characteristic of the language used?

   • AClear and concise
   • BVague to avoid revealing sensitive details
   • CHighly technical with jargon
   • DLengthy to cover all details
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   You are correlating logs from a web server, a database server, and an authentication server. The web server log shows a SQL injection attempt at 10:00. The database server log shows a query that returned a large result set at 10:01. The authentication server log shows a new admin account created at 10:05. What is the most likely attack chain?

   • AThe admin account was created first, then used to perform the SQL injection.
   • BThe database query was a normal backup process, and the admin account was created for a new employee.
   • CThe SQL injection was a false positive and the admin account was created by a legitimate administrator.
   • DSQL injection to extract data, then privilege escalation to create an admin account.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which tool is specifically designed to aggregate and correlate logs from multiple sources for security analysis?

   • ASIEM (Security Information and Event Management)
   • BWireshark
   • Ctcpdump
   • Dnmap
   Reveal Solution Discussion Select an answer first