CompTIA
JK0-018 · Question #899
JK0-018 Question #899: Real Exam Question with Answer & Explanation
The correct answer is D. Incident time offsets were not accounted for.. See the full explanation below for the reasoning.
Question
The incident response team has received the following email message. From: [email protected] To: [email protected] Subject: Copyright infringement A copyright infringement alert was triggered by IP address 13.10.66.5 at 09: 50: 01 GMT. After reviewing the following web logs for IP 13.10.66.5, the team is unable to correlate and identify the incident. 09: 45: 33 13.10.66.5 http: //remote.site.com/login.asp?user=john 09: 50: 22 13.10.66.5 http: //remote.site.com/logout.asp?user=anne 10: 50: 01 13.10.66.5 http: //remote.site.com/access.asp?file=movie.mov 11: 02: 45 13.10.65.5 http: //remote.site.com/download.asp?movie.mov=ok Which of the following is the MOST likely reason why the incident response team is unable to identify and correlate the incident?
Options
- AThe logs are corrupt and no longer forensically sound.
- BTraffic logs for the incident are unavailable.
- CChain of custody was not properly maintained.
- DIncident time offsets were not accounted for.
Community Discussion
No community discussion yet for this question.