nerdexam
CompTIA

SY0-301 · Question #899

The incident response team has received the following email message. From: [email protected] To: [email protected] Subject: Copyright infringement A copyright infringement alert was…

The correct answer is D. Incident time offsets were not accounted for. The alert was triggered at 09:50:01 GMT. Looking at the web logs, the suspicious file access (movie.mov) occurred at 10:50:01 - exactly one hour later. This one-hour discrepancy indicates a clock/time zone offset between the alerting system and the web server. The incident…

Security operations

Question

The incident response team has received the following email message. From: [email protected] To: [email protected] Subject: Copyright infringement A copyright infringement alert was triggered by IP address 13.10.66.5 at 09: 50: 01 GMT. After reviewing the following web logs for IP 13.10.66.5, the team is unable to correlate and identify the incident. 09: 45: 33 13.10.66.5 http: //remote.site.com/login.asp?user=john 09: 50: 22 13.10.66.5 http: //remote.site.com/logout.asp?user=anne 10: 50: 01 13.10.66.5 http: //remote.site.com/access.asp?file=movie.mov 11: 02: 45 13.10.65.5 http: //remote.site.com/download.asp?movie.mov=ok Which of the following is the MOST likely reason why the incident response team is unable to identify and correlate the incident?

Options

  • AThe logs are corrupt and no longer forensically sound.
  • BTraffic logs for the incident are unavailable.
  • CChain of custody was not properly maintained.
  • DIncident time offsets were not accounted for.

How the community answered

(31 responses)
  • A
    10% (3)
  • B
    6% (2)
  • C
    16% (5)
  • D
    68% (21)

Explanation

The alert was triggered at 09:50:01 GMT. Looking at the web logs, the suspicious file access (movie.mov) occurred at 10:50:01 - exactly one hour later. This one-hour discrepancy indicates a clock/time zone offset between the alerting system and the web server. The incident response team is looking at the 09:50 timeframe in the logs and finding only a logout event, not the file access, because the logs and the alert system are not synchronized to the same time reference. Accounting for this offset would align the alert to the 10:50:01 log entry. The logs are not corrupt, chain of custody is irrelevant here, and traffic logs are clearly available.

Topics

#incident response#log analysis#time synchronization#forensic investigation

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice