A company's network experiences a sudden slowdown, prompting suspicion of a cyberattack. Network administrators utilize log analysis tools to scrutinize traffic patterns and pinpoint anomalies…

Question

Options

• AEnhancing network security protocols
• BIdentifying the source of the cyberattack
• COptimizing network performance
• DMonitoring employee internet usage

• A
  7% (3)
• B
  74% (31)
• C
  14% (6)
• D
  5% (2)

Explanation

According to the CHFI v11 curriculum under Network Forensics and Analyzing Network Attacks, the primary purpose of using network log analysis tools during a suspected Distributed Denial-of- Service (DDoS) attack is to identify the source and nature of the attack traffic. DDoS attacks overwhelm network resources by flooding them with a massive volume of malicious traffic originating from multiple compromised systems. By analyzing firewall logs, IDS/IPS logs, router logs, and server access logs, investigators can detect abnormal traffic patterns such as unusually high connection rates, repeated requests from multiple IP addresses, malformed packets, or protocol misuse. These indicators help forensic investigators trace the origin of attack traffic, identify botnet behavior, determine attack vectors (e.g., SYN flood, UDP flood, HTTP flood), and assess the scope and impact of the attack.

No community discussion yet for this question.