Joe, the security administrator, has determined that one of his web servers is under attack. Which of the following can help determine where the attack originated from?

The correct answer is D. Network sniffing. Network sniffing (packet capture) captures live network traffic, including source IP addresses, ports, and payloads, which allows Joe to identify where attack traffic is originating from. Capturing a system image preserves disk state but does not reveal real-time network…

Security operations

Question

Options

ACapture system image
BRecord time offset
CScreenshots
DNetwork sniffing

How the community answered

(69 responses)

A
3% (2)
B
9% (6)
C
1% (1)
D
87% (60)

Explanation

Network sniffing (packet capture) captures live network traffic, including source IP addresses, ports, and payloads, which allows Joe to identify where attack traffic is originating from. Capturing a system image preserves disk state but does not reveal real-time network traffic sources. Recording a time offset helps correlate log timestamps across systems but does not identify attacker origin on its own. Screenshots document visible application state. Network sniffing tools like Wireshark or tcpdump can capture the attacking host's IP and provide a full picture of the attack vector while the attack is in progress.

Topics

#network forensics#network sniffing#attack investigation#incident response

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice