AP Cybersecurity Drill 20: Reading Post-Incident Logs

Question 1. How many distinct source IP addresses appear in the log?

• A) 2 distinct source IP addresses appear in the log
• B) 5 distinct source IP addresses appear in the log
• C) 3 distinct source IP addresses appear in the log ✓
• D) 4 distinct source IP addresses appear in the log

Explanation: Choice C is correct. The addresses are 203.0.113.5, 203.0.113.9, and 203.0.113.20; .5 and .9 each appear twice, giving three distinct addresses. Choice A is incorrect. Two undercounts the unique addresses. Choice B is incorrect. Five counts every row rather than unique addresses. Choice D is incorrect. Four overcounts; only three distinct addresses appear.

Question 2. Which detail is the strongest indicator that this activity is suspicious?

• A) A service account that should only sign in from the internal server logged in from another source ✓
• B) The log happens to record times in the early-morning hours instead of around the middle of the day
• C) The account name svc-backup contains a single hyphen placed between the two words
• D) The various source addresses all fall within one single shared numeric range

Explanation: Choice A is correct. A service account that should only connect from the internal backup server instead authenticating from source addresses other than that server, overnight, is a clear behavioral anomaly. Choice B is incorrect. The hour alone is weak, since some legitimate jobs run at night. Choice C is incorrect. A hyphen in the name is irrelevant to risk. Choice D is incorrect. Sharing a numeric range is not by itself evidence of misuse.

Question 3. How should the analyst treat the AI tool's score that flagged this burst?

• A) As definitive proof that the account was breached, needing no further review
• B) As a reason to ignore the log, since automated tools handle incidents on their own
• C) As irrelevant, because scores from automated tools should never guide an analyst
• D) As a useful lead that still requires human confirmation against the actual log ✓

Explanation: Choice D is correct. An AI triage score is a prioritization signal, not a verdict; the analyst confirms it against the evidence, which is what the scenario describes. Choice A is incorrect. A score is not proof of compromise on its own. Choice B is incorrect. The tool surfaces leads but does not resolve incidents unattended. Choice C is incorrect. The score is a helpful starting point, not something to disregard.

Question 4. Which entry is the most important indicator of compromise to investigate first?

• A) The failed login attempt from 203.0.113.20 recorded at 02:12
• B) The successful sign-in from 203.0.113.9 recorded at 02:13 ✓
• C) The failed login attempt from 203.0.113.5 recorded at 02:11
• D) The failed login attempt from 203.0.113.9 recorded at 02:11

Explanation: Choice B is correct. The successful login after a burst of failures, from a source other than the expected internal backup server, is the entry that signals a possible breach. Choice A is incorrect. A failed attempt did not gain access. Choice C is incorrect. That row is also a failure, less urgent than a success. Choice D is incorrect. It too is a failed attempt rather than a successful entry.

Question 5. What is the best immediate response to the successful login on svc-backup?

• A) Wait several days to confirm whether the same pattern of activity happens again
• B) Delete the authentication log so the suspicious entries no longer appear
• C) Disable or reset the account and review what it accessed right after the login ✓
• D) Open the account to all external addresses so backups are never interrupted

Explanation: Choice C is correct. Disabling or resetting the possibly compromised account and reviewing its post-login activity contains the incident and scopes the damage. Choice A is incorrect. Waiting lets an intruder act longer. Choice B is incorrect. Deleting the log destroys evidence and does not stop the attacker. Choice D is incorrect. Opening access further would expand the exposure.