300-215 Question 103
Select 2You are tasked with investigating a potential security incident involving unusual DNS activity. You need to parse and search through logs collected from Cisco Umbrella to identify domains accessed by a specific IP address within the last 24 hours. Which of the following Python script snippets would achieve this task?
- A
import json
with open('umbrella_logs.json') as file: logs = json.load(file)
results = [entry for entry in logs if entry['client_ip'] == '192.168.1.10' and entry['timestamp'] >= '2023-10-10T00:00:00'] print(results)
- B
import csv
with open('umbrella_logs.csv') as file: reader = csv.DictReader(file) results = [] for row in reader: if row['client_ip'] == '192.168.1.10' and row['timestamp'] >= '2023-10-10T00:00:00': results.append(row) print(results)
- C
import os os.system('grep "192.168.1.10" umbrella_logs.json | grep "2023-10-10"')
- D
import json
with open('umbrella_logs.json') as file: logs = json.load(file)
results = [entry['domain'] for entry in logs if entry['client_ip'] == '192.168.1.10'] print(results)
Show answer and explanation
Correct answers: A, B
Explanation
To parse and search Cisco Umbrella logs, it is important to use structured data parsing methods such as JSON or CSV libraries in Python. The first two scripts correctly use these libraries to filter logs based on both the IP address and the timestamp, meeting the requirements of the task. The grep command and the fourth script are either incomplete or unsuitable for structured log analysis in this scenario.
- A. Correct.
This Python script correctly parses a JSON log file and filters for entries matching the specified IP address and timestamp range. This approach is valid for JSON-based logs.
- B. Correct.
This Python script correctly parses a CSV log file and filters for entries matching the specified IP address and timestamp range. This approach is valid for CSV-based logs.
- C. Incorrect.
While this command might filter some results, using
grepdoes not account for structured data parsing, such as nested fields or timestamp comparisons, which makes it unreliable for forensic log analysis. - D. Incorrect.
This script extracts domains accessed by the IP address but does not filter based on the timestamp. It does not meet the requirement of identifying logs within the last 24 hours.