200-201 · Question #312
A SOC analyst observed Ursnif malware at the SIEM dashboard. The analyst opened the PCAP file to search the certificate issue data. Where must the analyst navigate?
The correct answer is B. under the validity line. To locate certificate issue data, such as validity periods, within a PCAP file, an analyst should navigate to the 'validity' line in the certificate's details.
Question
A SOC analyst observed Ursnif malware at the SIEM dashboard. The analyst opened the PCAP file to search the certificate issue data. Where must the analyst navigate?
Options
- Aunder the rdnSequence line
- Bunder the validity line
- Cunder the subject
- Dunder the signed certificate
How the community answered
(43 responses)- A5% (2)
- B93% (40)
- D2% (1)
Why each option
To locate certificate issue data, such as validity periods, within a PCAP file, an analyst should navigate to the 'validity' line in the certificate's details.
The 'rdnSequence' refers to the Relative Distinguished Name (RDN) sequence within the subject or issuer name, not the certificate's validity period.
The 'validity' line in a digital certificate specifies the period during which the certificate is considered valid, including the 'notBefore' and 'notAfter' dates. This is the correct location to determine if a certificate has expired or is not yet active, which would indicate a certificate issue.
The 'subject' field identifies the entity to which the certificate is issued, not its validity period.
The 'signed certificate' refers to the entire certificate that has been digitally signed, not a specific field detailing its validity dates.
Concept tested: X.509 certificate fields analysis
Source: https://learn.microsoft.com/en-us/windows/win32/seccrypto/about-x-509-certificates
Topics
Community Discussion
No community discussion yet for this question.