The most important network information that should be observed from the logs during a Traceback is the intruder IP address, the victim IP address, the victim port, protocol information and the:

Question

Options

• Asource port
• Boperating system
• CMAC address
• Dtimestamp

• A
  6% (2)
• B
  9% (3)
• C
  3% (1)
• D
  82% (28)

Explanation

Timestamps (D) are critical during a traceback because they establish the sequence and timing of events, allowing investigators to correlate log entries across multiple systems, reconstruct the attack timeline, and prove causation - without them, the other data points are disconnected snapshots with no chronological context.

Why the distractors are wrong:

• (A) Source port - while useful in some contexts, source ports are often ephemeral and randomly assigned, making them unreliable for traceback reconstruction; they're also largely redundant given that the intruder IP is already captured.
• (B) Operating system - OS fingerprinting is valuable for vulnerability analysis but is not a core log field needed to trace an intrusion path.
• (C) MAC address - MACs only traverse a single network segment and are stripped at each router hop, so they don't survive across networks and aren't meaningful at the traceback level.

Memory tip: Think of a traceback as building a court case - you need who (IPs), how (protocol/ports), and when (timestamp). Without "when," you can't prove the events are connected or ordered, which makes the timestamp the glue that holds the entire forensic narrative together.

No community discussion yet for this question.