GCIH Practice Questions: Network and Log Investigations Domain

Correct Answer: C

Explanation: Analyzing DNS logs to identify unusual domain queries is the best first step, as it can quickly reveal if the malware is communicating with external command and control servers. Using Wireshark (A) is more appropriate for detailed analysis after initial identification. A network-wide antivirus scan (B) might not catch all malware types and is time-consuming. Conducting a full system restore (D) is premature without understanding the infection scope.

Correct Answer: B

Explanation: Reviewing the server's firewall logs for connections to blacklisted IPs is the best first step. Firewall logs provide a clear record of outgoing connections, making it easier to spot communications with blacklisted IPs. Checking the DNS cache (option A) may not directly indicate communication with blacklisted IPs. Reverse DNS lookups (option C) and port scans (option D) do not directly address the issue of identifying communications with blacklisted IPs.

Correct Answer: B

Explanation: The first step should be to review outbound traffic logs for unusual data transfers to quickly confirm whether data exfiltration is occurring. Conducting a full forensic disk analysis (A) is too time-consuming for an initial step. Isolating systems (C) might be necessary later but is disruptive if done prematurely. Running antivirus (D) is not directly related to confirming data exfiltration.

Correct Answer: C

Explanation: The best first step is to check the domains against threat intelligence feeds. This can quickly identify if the domains are known for malicious activities. Option A, conducting a WHOIS lookup, provides ownership information but not threat status. Option B, performing a DNS query, only checks if the domains resolve, not their threat level. Option D, pinging the domains, tests connectivity but does not provide information on malicious activity.

Correct Answer: B

Explanation: A SYN flood attack is characterized by multiple SYN packets sent to a target without the attacker responding to the SYN-ACK replies. This exhausts the target's connection table by leaving many half-open connections.

Correct Answer: C

Explanation: Checking the firewall logs for entries related to the known malicious IP address is the most effective initial action. This provides quick visibility into any past or ongoing communications between the device and the malicious IP without disrupting the network. Using Wireshark (option A) is more time-consuming and may not be feasible immediately. Running a full Nmap scan (option B) does not directly address the suspicion of communication with a specific IP. Isolating the device (option D) is premature without confirmation of malicious activity.

Correct Answer: B

Explanation: Active Directory event logs should be prioritized for analysis to identify lateral movement. These logs can reveal authentication attempts and access patterns across network resources. Web server, email server, and DHCP server logs are less likely to provide direct insights into lateral movement within a network.

Correct Answer: D

Explanation: Authentication logs should be checked first to quickly determine if there have been any unauthorized access attempts. These logs typically contain records of successful and failed login attempts, which are crucial for identifying unauthorized access. Web server access logs (option A) and application logs (option B) may not provide direct information about login attempts. System event logs (option C) could be useful but are broader and less focused on authentication.

Correct Answer: A

Explanation: Wireshark can be used to capture and analyze network traffic. By filtering traffic on port 443, you can examine whether the payloads are consistent with SSL/TLS or if they contain unusual patterns indicative of a Netcat reverse shell. Options B, C, and D are less effective for directly identifying covert channels on a specific port.

Correct Answer: A

Explanation: Wireshark is the best initial tool to verify communication with a C2 server as it allows you to capture and analyze network traffic in real-time. Nmap is used for network scanning, Exiftool is for metadata analysis, and Metasploit is a penetration testing framework, none of which are directly suitable for initial verification of network communications.