200-201 · Question #42
An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?
The correct answer is C. 5-tuple. The 5-tuple refers to a set of five values used to uniquely identify a network connection or session. These values include source and destination IP addresses, source and destination port numbers, and the protocol (such as TCP or UDP) being used for communication. Together…
Question
An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?
Options
- Asequence numbers
- BIP identifier
- C5-tuple
- Dtimestamps
How the community answered
(59 responses)- A3% (2)
- B7% (4)
- C88% (52)
- D2% (1)
Explanation
The 5-tuple refers to a set of five values used to uniquely identify a network connection or session. These values include source and destination IP addresses, source and destination port numbers, and the protocol (such as TCP or UDP) being used for communication. Together, these five attributes uniquely define a network session, allowing security analysts to correlate logs or network traffic related to a specific communication session across different devices or logs within a network environment.
Topics
Community Discussion
No community discussion yet for this question.