GAQM
CPEH-001 · Question #73
You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address…
The correct answer is B. Internet Firewall/Proxy log. See the full explanation below for the reasoning.
Question
You are a security officer of a company. You had an alert from IDS that indicates that one PC on your Intranet is connected to a blacklisted IP address (C2 Server) on the Internet. The IP address was blacklisted just before the alert. You are staring an investigation to roughly analyze the severity of the situation. Which of the following is appropriate to analyze?
Options
- AEvent logs on the PC
- BInternet Firewall/Proxy log
- CIDS log
- DEvent logs on domain controller
How the community answered
(40 responses)- A5% (2)
- B80% (32)
- C13% (5)
- D3% (1)
Community Discussion
No community discussion yet for this question.