During which phase of incident response would an analyst review the data below?

The correct answer is C. Detection. The screenshot shows the output of tcpdump capturing network traffic on port 27017. The captured packets are SYN packets (Flags [S]), indicating attempts to initiate TCP connections from IP 172.16.66.133 to various hosts on port 27017 (commonly used by MongoDB).

Incident Response & Cyber Kill Chain

Question

Exhibit

Options

APreparation
BReconnaissance
CDetection
DEnumeration

How the community answered

(42 responses)

A
5% (2)
B
2% (1)
C
90% (38)
D
2% (1)

Explanation

The screenshot shows the output of tcpdump capturing network traffic on port 27017. The captured packets are SYN packets (Flags [S]), indicating attempts to initiate TCP connections from IP 172.16.66.133 to various hosts on port 27017 (commonly used by MongoDB).

Topics

#IR phases#detection#incident response lifecycle#log review

Community Discussion

No community discussion yet for this question.

Full GCIH Practice