PRACTICE
PBQS

Performance Based Question 03

Instructions: Read the Scenario below. Then answer the questions.

Scenario:

You are a security analyst investigating a potential infection on a network. Click on each host and firewall. Review all logs to determine which host originated the infection. Decide which hosts are clean or infected.
 
The network structure is as follows:
 
Boundary firewall

192.168.10.22 (Customer services workstation)
192.168.10.37 (Customer services workstation)
192.168.10.41 (Customer services workstation)

10.10.9.12 (Private engineering lab)
10.10.9.18 (Private engineering lab)

Boundary Firewall Logs

Customer Services Network

15-06-26 14:30 Info Scheduled malware scan initiated
15-06-26 14:30 Info Checking for updates
15-06-26 14:32 Info No updates available
15-06-26 14:32 Info Scan type = full
15-06-26 14:32 Info Scan start
15-06-26 14:32 Info Scanning system files
15-06-26 14:35 Info Scanning temporary files
15-06-26 14:35 Info Scanning Windows services
15-06-26 14:39 Info Scanning boot sector
15-06-26 14:39 Warn Scheduled scan disabled by process svch0st.exe
15-06-26 14:40 Warn Scheduled update disabled by process svch0st.exe
15-06-26 14:40 Info Files removed: 0
15-06-26 14:40 Info Files quarantined: 0

15-06-26 14:30 Info Scheduled malware scan initiated
15-06-26 14:30 Info Checking for updates
15-06-26 14:32 Info Definition update available v10.2.3.4440
15-06-26 14:32 Info Downloading update
15-06-26 14:32 Info Update complete
15-06-26 14:32 Info Scan type = full
15-06-26 14:32 Info Scan start
15-06-26 14:32 Info Scanning system files
15-06-26 14:35 Info Scanning temporary files
15-06-26 14:35 Info Scanning Windows services
15-06-26 14:39 Info Scanning boot sector
15-06-26 14:39 Warn File found svch0st.exe matches malicious definition v10.2.3.4440
15-06-26 14:40 Warn File quarantined svch0st.exe
15-06-26 14:40 Info Files removed: 0
15-06-26 14:40 Info Files quarantined: 1

15-06-26 14:30 Info Scheduled malware scan initiated
15-06-26 14:30 Info Checking for updates
15-06-26 14:32 Info Unable to reach update server
15-06-26 14:32 Info Scan type = full
15-06-26 14:32 Info Scan start
15-06-26 14:32 Info Scanning system files
15-06-26 14:35 Info Scanning temporary files
15-06-26 14:35 Info Scanning Windows services
15-06-26 14:39 Info Scanning boot sector
15-06-26 14:39 Warn File found svch0st.exe matches heuristic pattern (abnormal baseline)
15-06-26 14:40 Warn File quarantined svch0st.exe
15-06-26 14:40 Info Files removed: 0
15-06-26 14:40 Info Files quarantined: 1
Private Engineering Network

15-06-26 14:30 Info Scheduled malware scan initiated
15-06-26 14:30 Info Checking for updates
15-06-26 14:32 Info No update available
15-06-26 14:32 Info Scan type = full
15-06-26 14:32 Info Scan start
15-06-26 14:32 Info Scanning system files
15-06-26 14:35 Info Scanning temporary files
15-06-26 14:35 Info Scanning Windows services
15-06-26 14:39 Info Scanning boot sector
15-06-26 14:39 Warn File found svch0st.exe matches heuristic pattern (abnormal baseline)
15-06-26 14:40 Warn File quarantined svch0st.exe
15-06-26 14:40 Info Files removed: 0
15-06-26 14:40 Info Files quarantined: 1

15-06-26 14:30 Info Scheduled malware scan initiated
15-06-26 14:30 Info Checking for updates
15-06-26 14:32 Info No update available
15-06-26 14:32 Info Scan type = full
15-06-26 14:32 Info Scan start
15-06-26 14:32 Info Scanning system files
15-06-26 14:35 Info Scanning temporary files
15-06-26 14:35 Info Scanning Windows services
15-06-26 14:39 Info Scanning boot sector
15-06-26 14:39 Warn File found svch0st.exe matches heuristic pattern (abnormal baseline)
15-06-26 14:40 Error Unable to quarantine file svch0st.exe
15-06-26 14:42 Info Proceeding with scan
15-06-26 14:40 Info Files removed: 0
15-06-26 14:40 Info Files quarantined: 0

Question 1 of 7

Where did the infection originate (start)?

Question 2 of 7

What is the status of host 192.168.10.22 now?

Question 3 of 7

What is the status of host 192.168.10.37 now?

Question 4 of 7

What is the status of host 192.168.10.41 now?

Question 5 of 7

What is the status of host 10.10.9.12 now?

Question 6 of 7

What is the status of host 10.10.9.18 now?

Question 7 of 7

Based on the information shown in the firewall logs, what is the MOST LIKELY goal of any attack, if there is one?