SY0-301 · Question #899
The incident response team has received the following email message. From: [email protected] To: [email protected] Subject: Copyright infringement A copyright infringement alert was…
The correct answer is D. Incident time offsets were not accounted for. The alert was triggered at 09:50:01 GMT. Looking at the web logs, the suspicious file access (movie.mov) occurred at 10:50:01 - exactly one hour later. This one-hour discrepancy indicates a clock/time zone offset between the alerting system and the web server. The incident…
Question
The incident response team has received the following email message. From: [email protected] To: [email protected] Subject: Copyright infringement A copyright infringement alert was triggered by IP address 13.10.66.5 at 09: 50: 01 GMT. After reviewing the following web logs for IP 13.10.66.5, the team is unable to correlate and identify the incident. 09: 45: 33 13.10.66.5 http: //remote.site.com/login.asp?user=john 09: 50: 22 13.10.66.5 http: //remote.site.com/logout.asp?user=anne 10: 50: 01 13.10.66.5 http: //remote.site.com/access.asp?file=movie.mov 11: 02: 45 13.10.65.5 http: //remote.site.com/download.asp?movie.mov=ok Which of the following is the MOST likely reason why the incident response team is unable to identify and correlate the incident?
Options
- AThe logs are corrupt and no longer forensically sound.
- BTraffic logs for the incident are unavailable.
- CChain of custody was not properly maintained.
- DIncident time offsets were not accounted for.
How the community answered
(31 responses)- A10% (3)
- B6% (2)
- C16% (5)
- D68% (21)
Explanation
The alert was triggered at 09:50:01 GMT. Looking at the web logs, the suspicious file access (movie.mov) occurred at 10:50:01 - exactly one hour later. This one-hour discrepancy indicates a clock/time zone offset between the alerting system and the web server. The incident response team is looking at the 09:50 timeframe in the logs and finding only a logout event, not the file access, because the logs and the alert system are not synchronized to the same time reference. Accounting for this offset would align the alert to the 10:50:01 log entry. The logs are not corrupt, chain of custody is irrelevant here, and traffic logs are clearly available.
Topics
Community Discussion
No community discussion yet for this question.