CCD Log Analysis & Forensics 2 — Questions and Answers
Question 1: Which Windows Event ID indicates a failed logon attempt?
- 4624
- 4625 (Correct answer)
- 4648
- 4672
Correct answer: 4625
Event ID 4625 is logged when an account fails to log on to a Windows system.
Question 2: A SIEM alert fires on 500 failed SSH logins from one IP in 60 seconds. What attack pattern does this most likely indicate?
- Credential stuffing
- Brute-force / dictionary attack (Correct answer)
- Pass-the-hash
- ARP poisoning
Correct answer: Brute-force / dictionary attack
High-volume rapid login attempts against a single service from one source is the hallmark of a brute-force or dictionary attack.
Question 3: In Linux, which log file records authentication events such as sudo usage and SSH logins on Debian-based systems?
- /var/log/syslog
- /var/log/auth.log (Correct answer)
- /var/log/kern.log
- /var/log/dmesg
Correct answer: /var/log/auth.log
/var/log/auth.log captures PAM, SSH, and sudo authentication events on Debian/Ubuntu systems.
Question 4: During a forensic investigation you find that /etc/passwd was modified at 02:14 AM but no user account changes appear in audit logs. What should you suspect?
- Log rotation removed the entries
- An attacker modified the file and cleared audit logs (Correct answer)
- The file system clock drifted
- Cron ran a legitimate update
Correct answer: An attacker modified the file and cleared audit logs
Missing audit entries combined with unauthorized file modification strongly suggests an attacker edited the file and tampered with or cleared audit logs.
Question 5: What does the 'c' flag in an auditd rule such as '-a always,exit -F arch=b64 -S open -F success=0' indicate?
- Create a new file
- Capture failed system calls (Correct answer)
- Log only cached events
- Count occurrences only
Correct answer: Capture failed system calls
The '-F success=0' filter tells auditd to record only failed syscalls, useful for detecting unauthorized access attempts.
Question 6: A forensic analyst extracts a memory dump and finds a process named 'svchost.exe' running from C:\Users\Public. What is significant about this?
- svchost.exe always runs from user directories
- Legitimate svchost.exe runs only from System32; this path indicates malware (Correct answer)
- Public directory is a standard Microsoft path for services
- This is expected behavior on Windows 11
Correct answer: Legitimate svchost.exe runs only from System32; this path indicates malware
Legitimate svchost.exe resides exclusively in C:\Windows\System32; execution from a user-writable path is a strong indicator of malware masquerading as a system process.
Question 7: Which forensic artifact on Windows stores evidence of recently executed programs even after the executables are deleted?
- Event Viewer logs
- Prefetch files (Correct answer)
- Recycle Bin metadata
- VSS shadow copies
Correct answer: Prefetch files
Windows Prefetch files (.pf) in C:\Windows\Prefetch record the last run time and file paths of executed programs, persisting after the binary is removed.
CCD Log Analysis & Forensics 2
Which Windows Event ID indicates a failed logon attempt?