nerdexam
Cisco

210-255 · Question #15

What information from HTTP logs can be used to find a threat actor?

The correct answer is B. IP address. The IP address field in HTTP logs is the primary artifact used to attribute requests to a specific source and identify a threat actor. Other HTTP log fields describe request metadata but cannot uniquely identify the requester.

Security Monitoring

Question

What information from HTTP logs can be used to find a threat actor?

Options

  • Areferer
  • BIP address
  • Cuser-agent
  • DURL

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    89% (16)
  • C
    6% (1)

Why each option

The IP address field in HTTP logs is the primary artifact used to attribute requests to a specific source and identify a threat actor. Other HTTP log fields describe request metadata but cannot uniquely identify the requester.

Areferer

The referer field shows the originating URL that linked to a resource and provides navigational context, but it does not identify who made the request.

BIP addressCorrect

The source IP address recorded in HTTP logs directly ties a request to a specific host, allowing analysts to correlate the address against threat intelligence feeds, geolocation data, and other logs to attribute activity to a threat actor.

Cuser-agent

The user-agent field identifies the client software or browser, which is trivially spoofed and cannot reliably or uniquely identify a threat actor.

DURL

The URL field identifies which resource was requested on the server, but does not contain information about the identity or location of the requester.

Concept tested: HTTP log field analysis for threat attribution

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf

Topics

#HTTP logs#IP address analysis#threat actor identification#log analysis

Community Discussion

No community discussion yet for this question.

Full 210-255 Practice