QuestionQ28

Forensics

Refer to the exhibit.

Question Image

Which IP address should be recorded as a potentially compromised client?

  • A 10.254.1.21
  • B 10.1.26.151
  • C 10.1.26.1
  • D 10.1.7.100
Explanation

The potentially compromised client is the internal host initiating DNS queries for .onion domains and related traffic to 10.254.1.21. Those suspicious requests originate from 10.1.26.151.

Community Discussion

No comments yet. Be the first to start the discussion!