Eccouncil 212-82 Exam - Topic 7 Question 26 Discussion

Actual exam question for Eccouncil's 212-82 exam

Question #: 26
Topic #: 7

[All 212-82 Questions]

The SOC department in a multinational organization has collected logs of a security event as

"Windows.events.evtx". Study the Audit Failure logs in the event log file located in the Documents folder of the

-Attacker Maehine-1" and determine the IP address of the attacker. (Note: The event ID of Audit failure logs is

4625.)

(Practical Question)

A10.10.1.12

B10.10.1.10

C10.10.1.16

D10.10.1.19

Show Suggested Answer

Suggested Answer: C

The IP address of the attacker is 10.10.1.16. This can be verified by analyzing the Windows.events.evtx file using a tool such as Event Viewer or Log Parser. The file contains several Audit Failure logs with event ID 4625, which indicate failed logon attempts to the system. The logs show that the source network address of the failed logon attempts is 10.10.1.16, which is the IP address of the attacker3. The screenshot below shows an example of viewing one of the logs using Event Viewer4: Reference: Audit Failure Log, [Windows.events.evtx], [Screenshot of Event Viewer showing Audit Failure log]

by Daren at Apr 24, 2024, 01:26 PM

Limited Time Offer

25%

Off

Get Premium 212-82 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Veta

3 months ago

This is confusing, are we sure those logs are accurate?

upvoted 0 times

...

Mozell

3 months ago

Wait, how can we be sure it's not 10.10.1.10?

upvoted 0 times

...

Dorethea

3 months ago

Not sure about that, I got 10.10.1.19 from my analysis.

upvoted 0 times

...

Lashanda

4 months ago

I think it's 10.10.1.12, looks right to me!

upvoted 0 times

...

Lindsey

4 months ago

The event ID for audit failures is definitely 4625.

upvoted 0 times

...

Ayesha

4 months ago

I feel like I’ve seen 10.10.1.19 in our practice logs before, but I’m not certain if that’s the right one for this scenario.

upvoted 0 times

...

Marisha

4 months ago

This question reminds me of a similar practice we did where we had to identify failed login attempts. I think it was 10.10.1.12, but I’m not completely confident.

upvoted 0 times

...

Rozella

4 months ago

I think the IP address should be in the details of the event ID 4625, but I can't recall if it’s always listed in the same format.

upvoted 0 times

...

Rozella

5 months ago

I remember we practiced analyzing event logs, but I’m not sure how to pinpoint the exact IP from the Audit Failure logs.

upvoted 0 times

...

Fannie

5 months ago

No problem, I've got this. I'll scan through the Audit Failure logs, find the IP address associated with the failed login attempts, and submit that as my answer.

upvoted 0 times

...

Tyra

5 months ago

This seems like a good opportunity to apply the skills we've been practicing. I'll carefully review the Audit Failure logs and look for any IP addresses that stand out as potential attackers.

upvoted 0 times

...

Valene

5 months ago

Hmm, I'm a bit unsure about this one. Do we need to analyze the entire event log file or just the Audit Failure logs? And how do I determine the IP address from the logs?

upvoted 0 times

...

Leoma

5 months ago

Okay, this looks straightforward. I'll start by locating the "Windows.events.evtx" file in the Documents folder of the "Attacker Machine-1" and then search for the Audit Failure logs with event ID 4625.

upvoted 0 times

...

Brynn

5 months ago

Hmm, I'm not totally sure about this one. There are a few different options, and I'm not sure which one would be the most convincing for upper management. I'll have to think this through carefully.

upvoted 0 times

...

Apolonia

5 months ago

I'm a bit confused because I remember echoic responses involve repeating what someone else says, but this doesn't seem like that.

upvoted 0 times

...

Vanesa

5 months ago

I'm pretty confident I know the responsibilities of the Service Desk Analyst (SDA) in the Incident Management process. I think the key ones are logging, escalating, and closing incidents.

upvoted 0 times

...

Dorthy

5 months ago

Okay, let's see. The question says I enabled deduplication properly, so that's not the issue. Maybe it's related to the copies property or the dedupratio property on the zpool.

upvoted 0 times

...