Free Investigations and Digital Forensics practice questions

Sub status 0xC000006A means the user name is real and the password is wrong, and a few attempts spread across many real accounts from one source is password spraying with a valid user list. Guessing names would show 0xC0000064, meaning the name doesn't exist, a brute-force attack concentrates on one account, and ordinary typos don't come from one address against 300 accounts.

Output octets are what the VPN sent toward the user and input octets are what came back from the user, so about 4.1 GB left the corporate network for the remote machine while about 52 MB came in. Reading the fields the other way round reverses the finding, and accounting records carry byte counts for both directions as well as the session time.

The subject is the account that performed the action and the member is the account it was done to, and 4732 records an addition to a local group, so hd-tech04 added contractor-07 to Administrators on that server. Additions to a domain global group such as Domain Admins are event 4728, and account creation is 4720.

A DNS log proves a name was looked up, not that a connection followed, so it should be paired with firewall or proxy records showing traffic to that address. Another lookup is still only a lookup, logon events show who signed in, and a message trace shows who received an email.

Endpoint logs answer what actually ran, and Sysmon event 1 records process creation with the full command line, as does Windows event 4688 when command-line capture is enabled. Firewall, DNS and RADIUS records show traffic, lookups and sessions, never the command a process was started with.

Call detail records are communication logs that show which number called, when and for how long, so they reveal an outside caller just before the reset, a sign of vishing. A message trace follows email, a proxy log records web requests, and RADIUS accounting covers VPN sessions.

An open, remotely exploitable flaw makes the gateway a leading candidate for initial access, so investigators pull its logs first to confirm it and search the scan data for other hosts with the same finding. A scan finding alone doesn't prove the attacker used it, being point-in-time doesn't make it irrelevant, and a scan says nothing about what data left.

Exporters split long flows into several records at their active timeout, commonly 30 minutes on Cisco gear, so consecutive records with the same key fields are one transfer whose byte counts you add together. Separate uploads by different processes would use different source ports, beaconing is small regular check-ins rather than 600 MB at a time, and a scan touches many ports with tiny flows.

In TLS traffic a capture still shows addresses, timing, sizes and usually the server name from the handshake, but not the content unless the session keys are available or a TLS inspection proxy decrypted it. File names and contents, URL paths, form fields and credentials are all inside the encrypted payload.

Automated reports are scheduled summaries, and in an investigation they supply the baseline that shows whether tonight's volume is abnormal. A packet capture shows tonight's traffic in detail, a vulnerability scan shows weaknesses, and footage shows who was physically present; none of them records what normal looks like.