Bird
0
0

In a forensic investigation, you need to identify the source of a network attack using logs. Which combined approach is best?

hard🚀 Application Q9 of 15
Cybersecurity - Digital Forensics
In a forensic investigation, you need to identify the source of a network attack using logs. Which combined approach is best?
ACheck marketing emails for suspicious links
BOnly review firewall logs for attack details
CAnalyze user activity logs without network data
DCorrelate firewall logs with system logs and IP address geolocation
Step-by-Step Solution
Solution:

  1. Step 1: Understand the need for multiple data sources

    Firewall logs show network traffic, system logs show host activity, and geolocation helps locate IP origins.

  2. Step 2: Combine logs for comprehensive analysis

    Correlating these sources provides a clearer picture of the attack source and path.

  3. Final Answer:

    Correlate firewall logs with system logs and IP address geolocation -> Option D

  4. Quick Check:

    Best source ID = Correlate multiple logs + geolocation [OK]
Quick Trick: Combine logs and geolocation for attack source tracing [OK]
Common Mistakes:
MISTAKES
  • Relying on a single log source
  • Ignoring network data in investigations

Want More Practice?

15+ quiz questions · All difficulty levels · Free

Free Signup - Practice All Questions
More Cybersecurity Quizzes
Advanced Threat Protection - Threat hunting techniques - Quiz 12easy Advanced Threat Protection - Security Orchestration and Automation (SOAR) - Quiz 10hard Advanced Threat Protection - Security Orchestration and Automation (SOAR) - Quiz 6medium Compliance and Governance - Risk assessment methodologies - Quiz 10hard Emerging Security Topics - Supply chain security - Quiz 7medium Emerging Security Topics - Quantum computing threats to cryptography - Quiz 8hard Emerging Security Topics - AI in cybersecurity (defense and offense) - Quiz 4medium Incident Response - Incident response lifecycle - Quiz 7medium Incident Response - Eradication and recovery - Quiz 11easy Incident Response - Communication during incidents - Quiz 1easy