Discuss EC-Council 212-82 Exam Topic 7 Question 26

The SOC department in a multinational organization has collected logs of a security event as

"Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder of the

-Attacker Maehine-1" and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is

4625.)

(Practical Question)

A10.10.1.12

B10.10.1.10

C10.10.1.16

D10.10.1.19

Suggested Answer: C

The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The logs show that the source network address of the failed logon attempts is 10.10.1.16, which is the IP address of the attacker3. The screenshot below shows an example of viewing one of the logs using Event Viewer4: Reference: Audit Failure Log, [Windows.events.evtx], [Screenshot of Event Viewer showing Audit Failure log]

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

28 comments · newest first

Veta 11 months ago

This is confusing, are we sure those logs are accurate?

Mozell 11 months ago

Wait, how can we be sure it's not 10.10.1.10?

Dorethea 11 months ago

Not sure about that, I got 10.10.1.19 from my analysis.

Lashanda 12 months ago

I think it's 10.10.1.12, looks right to me!

Lindsey 12 months ago

The event ID for audit failures is definitely 4625.

Ayesha 1 year ago

I feel like I’ve seen 10.10.1.19 in our practice logs before, but I’m not certain if that’s the right one for this scenario.

Marisha 1 year ago

This question reminds me of a similar practice we did where we had to identify failed login attempts. I think it was 10.10.1.12, but I’m not completely confident.

Rozella 1 year ago

I think the IP address should be in the details of the event ID 4625, but I can't recall if it’s always listed in the same format.

Rozella 1 year ago

I remember we practiced analyzing event logs, but I’m not sure how to pinpoint the exact IP from the Audit Failure logs.

Fannie 1 year ago

No problem, I've got this. I'll scan through the Audit Failure logs, find the IP address associated with the failed login attempts, and submit that as my answer.

Tyra 1 year ago

This seems like a good opportunity to apply the skills we've been practicing. I'll carefully review the Audit Failure logs and look for any IP addresses that stand out as potential attackers.

Valene 1 year ago

Hmm, I'm a bit unsure about this one. Do we need to analyze the entire event log file or just the Audit Failure logs? And how do I determine the IP address from the logs?

Leoma 1 year ago

Okay, this looks straightforward. I'll start by locating the "Windows.events.evtx" file in the Documents folder of the "Attacker Machine-1" and then search for the Audit Failure logs with event ID 4625.

Brynn 1 year ago

Hmm, I'm not totally sure about this one. There are a few different options, and I'm not sure which one would be the most convincing for upper management. I'll have to think this through carefully.

Apolonia 1 year ago

I'm a bit confused because I remember echoic responses involve repeating what someone else says, but this doesn't seem like that.

Vanesa 1 year ago

I'm pretty confident I know the responsibilities of the Service Desk Analyst (SDA) in the Incident Management process. I think the key ones are logging, escalating, and closing incidents.

Dorthy 1 year ago

Okay, let's see. The question says I enabled deduplication properly, so that's not the issue. Maybe it's related to the copies property or the dedupratio property on the zpool.

Cyndy 1 year ago

Hmm, I'm not too familiar with the backup options for Cloud Pak for Data System. I'll need to think this through carefully.

Ethan 1 year ago

I'm a bit confused, but I think A is definitely wrong. High prices don't lead to high demand, right?

Charlene 2 years ago

Sure, I noticed a recurring IP address in the log files corresponding to that value.

Kanisha 2 years ago

Interesting, can you explain why you think A) 10.10.1.12 is the correct answer?

Charlene 2 years ago

I'm leaning towards A) 10.10.1.12 because of the patterns I observed in the event log file.

Samira 2 years ago

I disagree, I believe it's C) 10.10.1.16 based on the logs I analyzed.

Kanisha 3 years ago

I think the answer is B) 10.10.1.10.

Lashawn 3 years ago

I guess we'll have to look deeper into the logs to find out for sure.

Colette 3 years ago

I am leaning towards 10.10.1.16.

Jina 3 years ago

I disagree, I believe it is 10.10.1.10.

Lashawn 3 years ago

I think the IP address of the attacker is 10.10.1.12.

EC-Council 212-82 Exam - Topic 7 Question 26 Discussion