English
Menu

Cyber Attacks and Defense in Practice

The logs of two servers are being compared in an intrusion investigation. The web server logs in Coordinated Universal Time (UTC), and its clock was set correctly by NTP. The file server logs in Japan time (UTC+9 hours), and its clock was 4 minutes ahead of the correct time. The web server log records a suspicious login at 01:52 (UTC), and the file server log records a mass read of files at 10:58 (Japan time). How many minutes after the suspicious login did the file reads actually happen?

  1. A2 minutes later
  2. B6 minutes later
  3. C10 minutes later
Show answer and explanation

Answer: A. 2 minutes later

The file server's clock was 4 minutes ahead, so subtracting 4 minutes from the logged 10:58 gives the correct Japan time of 10:54. Japan time is 9 hours ahead of UTC, so in UTC this is 01:54, 2 minutes after the suspicious login at 01:52. Without correcting the clock error, 10:58 − 9 h = 01:58 gives 6 minutes, and correcting in the wrong direction gives 11:02 − 9 h = 02:02, or 10 minutes, misjudging the interval between the events. To prevent such errors, the clocks of all devices are synchronized with NTP, times are logged in a form that makes the time zone clear (such as UTC), and the logs are collected and stored in a separate, tamper-resistant place.

  • A. Correct. Correcting the clock error gives 10:54 (Japan time), which is 01:54 in UTC, so 2 minutes later.
  • B. This value corrects only the time-zone difference, without correcting for the clock being 4 minutes ahead.
  • C. This value adds the clock error where it should have been subtracted.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. In the same week, fixes were released for three vulnerabilities. The operations staff can apply only one fix per day. Which of the following is the most appropriate combination of the fix to apply first and the reason?
  2. Which of the following correctly describes the differences between vulnerability scanning, penetration testing and red team exercises as ways of checking an organization's defenses?
  3. An outside security researcher has found an undisclosed vulnerability in a company's product. Which of the following is the most appropriate way to proceed according to the idea of coordinated vulnerability disclosure?
  4. Which of the following is the main purpose of creating and maintaining an SBOM (software bill of materials)?
  5. A company uses an internal-only library named acme-utils, kept in its internal package repository (private registry). An attacker registered a package with the same name, acme-utils, and a higher version number in a public package repository, and it turned out that, depending on the build settings, the internal build environment could pull in the attacker's package. Which of the following is the most appropriate countermeasure to this "dependency confusion"?

Comparisons in this topic