312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ129

VerifiedLog Management

As a SOC analyst, John is concerned about the volume of Tor traffic reaching the network. He wants to build a SIEM dashboard with a graph that identifies the locations from which the Tor traffic originates. Which of the following data sources will he use to create the dashboard?

Explanation

DHCP logs that retain IP-address or hostname mappings, together with IP-to-name resolution, provide the identity correlation needed to associate Tor-related source IPs with their originating hosts or locations. DHCP events commonly supply IP, MAC-address, and hostname information for this type of SIEM identity and location correlation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!