200-201 · Question #178
A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?
The correct answer is B. protocol, source IP, source port, destination IP, and destination port. The 5-tuple approach for identifying network connections in logs consists of the protocol, source IP address, source port, destination IP address, and destination port.
Question
A threat actor penetrated an organization's network. Using the 5-tuple approach, which data points should the analyst use to isolate the compromised host in a grouped set of logs?
Options
- Aevent name, log source, time, source IP, and host name
- Bprotocol, source IP, source port, destination IP, and destination port
- Cevent name, log source, time, source IP, and username
- Dprotocol, log source, source IP, destination IP, and host name
How the community answered
(29 responses)- A3% (1)
- B93% (27)
- C3% (1)
Why each option
The 5-tuple approach for identifying network connections in logs consists of the protocol, source IP address, source port, destination IP address, and destination port.
This combination includes event name, log source, time, and host name, which are not components of the standard 5-tuple used to identify a network flow.
The 5-tuple is a standard method to uniquely identify a network connection or flow and consists precisely of the protocol, source IP address, source port, destination IP address, and destination port.
This combination includes event name, log source, time, and username, none of which are standard components of the 5-tuple for network connection identification.
This combination includes log source and host name, which are not part of the standard 5-tuple, and it omits the crucial source and destination port numbers.
Concept tested: Network 5-tuple identification
Source: https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-netflow/prod_white_paper0900aecd80406232.html
Topics
Community Discussion
No community discussion yet for this question.