One caution an investigator should take when examining the source of a network attack is:

Question

Options

• Aan occurrence of Social Engineering
• Brelaxed physical security
• Cthe source IP address may have been spoofed
• Da sniffer could be on the network

• A
  12% (3)
• B
  15% (4)
• C
  69% (18)
• D
  4% (1)

Explanation

When tracing the origin of a network attack, investigators must account for IP spoofing - a technique where attackers forge the source IP address in packet headers to disguise their true location. Since IP addresses in network packets can be trivially falsified, pursuing the apparent source without verification can lead investigators to innocent third parties or dead ends, wasting time and potentially causing harm to uninvolved systems.

Why the distractors are wrong:

• A (Social Engineering): Social engineering is a threat vector (manipulating people), not a caution specific to tracing a network attack's source IP.
• B (Relaxed physical security): Physical security is a separate concern unrelated to the technical act of examining a network attack's origin.
• D (Sniffer on the network): A sniffer (packet capture tool) is a monitoring concern, not a caution about the source of the attack itself.

Memory tip: Think "Source = Suspect the Spool" - the Source IP could be Spoofed. In network forensics, always verify before you chase; the address you see may be a decoy.

No community discussion yet for this question.