- Welcome to Lesson 22: Deep Dive Quiz.
In lesson 22 we talked about
Given a Scenario, Using Data Sources
to Support an Investigation
and we only had one lesson, 22.1,
which was all about data sources.
So let's do five questions together.
Make sure you've got your pen, your pencil, your paper,
put me on pause as often as you need to
even if I don't even prompt you to
and I forget to do that.
Put me on, you know, don't forget to put me on pause
when you want to.
Let's get going.
Packet captures a process of intercepting
and logging traffic for analysis.
This packet capture mode accepts any frame it captures,
even if not the intended recipient.
We had this question in our three-second challenge,
so I'm sure you're gonna get it.
Is this normal, unfiltered, promiscuous, or filtered?
The packet capture mode accepts any frame it captures,
even if not the intended recipient.
What's it gonna be?
Yeah, for sure.
It's promiscuous.
Let's double check.
And that's correct.
The type of vulnerability scan
that can identify rogue access points,
SSID broadcasts, and weak protocols.
Network, wireless, application or host-base.
What do you like?
Rogue access points, SSID broadcast, and weak protocols.
That's gotta be what?
Absolutely, that's wireless.
Let's double check,
and that's correct.
All right, question three.
You're investigating a DoS attack, denial of service attack.
It appears that traffic is being redirected
from other internet domains to your site.
Which type of log would likely be the most useful?
An operating system log,
a NetFlow log,
a firewall log,
or a DNS log?
Traffic is being redirected
from other internet domains to your site.
So what type of log might be the most useful?
Operating system, NetFlow,
firewall, or DNS?
What do you think?
You can put me on pause if you need to.
I'm gonna go with DNS, right?
My DNS log because that should give me information
about IP address to DNS domain names mapping.
So let's see what we got,
if it's correct.
And that is correct.
All right, question four.
Metadata that includes comments, track changes,
and speaker notes.
Pseudo metadata, data packet metadata,
file system metadata, or application metadata.
So this includes things that a user created.
Comments, track changes, speaker notes,
could be embedded audio or visual video.
So pseudo metadata, data packet metadata,
file system metadata, or application metadata.
Well, let's see.
Let's start at the bottom.
Application metadata will be things like
how long you're using the application for,
if there's been any modifications for it.
Changes in name, changes in version,
so that doesn't work.
File system metadata is all about changes in file size,
in time, in file attributes.
Anything has to do specifically with a file.
Data packet metadata, it's all about the attributes
of the particular data packet itself.
Pseudo metadata is gonna be the best answer here.
You're gonna choose it?
You like it?
Let's check,
and that is correct.
All right, we are going to do a matching
and we only have three choices here.
A port mirror, a network TAP, and a sniffer.
We've got on the right-hand side,
a dedicated passive hardware device
that copies and forwards network packets for analysis;
captures network traffic from a switch
and forwards a copy of the traffic
to an analysis device;
or used to capture and analyze packets.
What do you think?
You wanna put me on pause?
Well, let's try it.
Well, right here, a sniffer's already there.
A sniffer is used to capture and analyze network packets.
Then we either have a dedicated passive hardware device
that copies and forwards network traffic
or network packets for analysis,
or we have captures network traffic from a switch
and forwards a copy of that traffic to an analysis device.
Well, a network TAP is going to be
a passive hardware device,
so let's choose that.
And a port mirror, well that just mirrors
various ports, right?
Like on a switch.
Captured network traffic from a switch
and forwards a copy of the traffic to an analysis device.
That's our port mirror.
The dedicated passive hardware device that copies
and forwards network packet information
is gonna be our network TAP,
and use to capture and analyze packets,
well that's gonna be our sniffer.
You agree?
All right, let's check it out.
And that is correct.
Great work.
All right, what's up next?
we're gonna move into module five.
Module five is all about
Security Program Management and Oversight.
And we're gonna start up with lesson 23,
which is Summarize Effective Security Governance.
Look forward to seeing you there.