312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ232

Logs and Network Forensics

An investigator is examining Apache access logs for suspicious traffic. She observes several requests for /admin.php from an IP address not normally linked to administrative access. What should she do next to determine whether this is an unauthorized-access attempt?

  • A Analyze the user-agent strings associated with the requests to identify the browser being used.
  • B Check the HTTP status codes in the log entries for these requests to identify whether they were successful.
  • C Review the timestamps of the requests to determine if they occurred during business hours.
  • D Cross-reference the IP address with the server’s DNS logs to see if it is part of a known network.
Explanation

HTTP status codes record the server’s response to each request and indicate whether access was successful or rejected, making them the most direct evidence for assessing a possible unauthorized access attempt.

Community Discussion

No comments yet. Be the first to start the discussion!