MENU
John as a SOC analyst is worried about the amount of Tor traffic hitting the network. He wants to prepare a dashboard in the SIEM to get a graph to identify the locations from where the TOR traffic is coming.
Which of the following data source will he use to prepare the dashboard?
Suggested Answer: D
Get Premium 312-39 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
14 comments · newest first
JO
Josephine
12 months ago
I’d go with Apache logs, they give a lot of detail on traffic sources.
ED
Edwin
12 months ago
Surprised that Tor traffic is a concern, isn't it usually encrypted?
GL
Glenn
12 months ago
Not so sure about that, DNS logs could also provide useful info.
OL
Oliva
1 year ago
Totally agree, DHCP logs are key for IP resolution!
MI
Micaela
1 year ago
I think DHCP logs would be the best choice for tracking IPs.
LI
Linn
1 year ago
I vaguely recall that Apache logs provide good information about IP addresses, but I’m not sure if they would help pinpoint Tor traffic specifically.
JE
Jenise
1 year ago
I feel like DNS logs might be relevant too, especially since they can show requests made to known Tor exit nodes.
EL
Elinore
1 year ago
I think IIS logs could be useful since they include user agent info, but I’m not entirely confident if that’s the best choice for identifying Tor traffic.
CO
Cordelia
1 year ago
I remember we discussed how DHCP logs can help track IP addresses, but I'm not sure if they would give enough detail for Tor traffic specifically.
AR
Ariel
1 year ago
This seems like a pretty straightforward question. I'd go with Custom Vision object detection - it's designed for identifying objects in images, which is exactly what we need here.
SH
Sheron
1 year ago
Okay, let me see if I can break this down. The key is to identify the step that is NOT required. Based on my understanding, comparing the original use of personal data to post-merger use is a crucial part of the diligence process, so I don't think that's the answer. I'm leaning towards C as the correct choice.
NO
Noel
1 year ago
I'm pretty confident that consensus leasing and synchronous leasing are the two correct answers here. Those scenarios definitely require node manager, but I'm not as sure about the other options.
SA
Sabrina
1 year ago
Okay, I think I've got a handle on this. The key is to focus on the svcprop command and what it can tell us about the system's configuration.
FL
Fletcher
1 year ago
Okay, let me think this through step-by-step. HIPAA is about protecting personal health information, so it makes sense that it would cover more than just paper records. I'll go with D - All of the above.