nerdexam
EC-Council

312-50V10 · Question #728

You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you must use regular expressions. Which co

The correct answer is D. Grep. Grep is the standard command-line utility for searching plain-text data using regular expressions, making it the ideal tool for fast log analysis.

Evading IDS, Firewalls, and Honeypots

Question

You have several plain-text firewall logs that you must review to evaluate network traffic. You know that in order to do fast, efficient searches of the logs you must use regular expressions. Which command-line utility are you most likely to use?

Options

  • ARelational Database
  • BMS Excel
  • CNotepad
  • DGrep

How the community answered

(31 responses)
  • B
    3% (1)
  • C
    3% (1)
  • D
    94% (29)

Why each option

Grep is the standard command-line utility for searching plain-text data using regular expressions, making it the ideal tool for fast log analysis.

ARelational Database

A relational database requires importing data into structured tables first and uses SQL rather than regex natively, making it impractical for quick ad-hoc log searches.

BMS Excel

MS Excel is a spreadsheet application without native regex support and is not a command-line utility suitable for fast log analysis.

CNotepad

Notepad is a basic GUI text editor that lacks regex search functionality and cannot efficiently handle large log files.

DGrepCorrect

Grep (Global Regular Expression Print) is a Unix/Linux command-line tool purpose-built for searching text using regular expressions. It can rapidly scan large plain-text log files line by line and return only matching patterns, making it the standard tool for network and firewall log analysis in security operations.

Concept tested: Using grep for regex-based log analysis

Source: https://www.gnu.org/software/grep/manual/grep.html

Topics

#grep#regular expressions#firewall logs#log analysis

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice