37. Network Incident Investigation and Remediation

Why is it important to take notes while watching the video tutorials?

• To skip the study hall sessions

• To become proficient with the tools and skills

• To master the skills in one go

• To avoid watching the video again

What should you do if you have questions while watching the video?

• Keep them to yourself

• Ask them on the YouTube channel

• Wait until the end of the series

• Ignore them

What is the first tool used in the investigation?

• Task Manager

• Event Viewer

• Security Onion

• Wireshark

What file type is opened with Wireshark during the investigation?

• .txt

• .csv

• .pcap

• .log

What does the push flag indicate in network traffic?

• Connection is being established

• Data is being sent

• Data is being received

• Connection is being terminated

What type of information was identified as PII in the traffic?

• IP addresses

• Email addresses and gender

• Port numbers

• MAC addresses

Which command is used to display the IPv4 address on Windows Server 2019?

• ipconfig

• ifconfig

• netstat

• ping

What command is used to check for active connections and listening ports?

• ipconfig

• netstat

• ping

• tracert

What was the name of the unauthorized account found?

• admin

• guest

• user1

• administrator1

Which tool was used to identify anomalous processes?

• Event Viewer

• Task Manager

• Wireshark

• Proc Explorer