300-215 Question 177
Select 3During a forensic investigation, you are tasked with analyzing logs from a compromised system. You notice that the attacker frequently uses a VPN service with dynamically changing IP addresses across different countries, deletes key system logs after executing commands, and employs encryption to hide communication data. Which antiforensic techniques are being demonstrated in this scenario?
- A
Geo location
- B
Obfuscation
- C
Evading detection
- D
Data destruction
- E
Hindering forensics
Show answer and explanation
Correct answers: A, C, D
Explanation
The attacker in the scenario uses a combination of antiforensic techniques: Geo location by using a VPN with dynamic IP addresses, evading detection by encrypting communications, and data destruction by deleting system logs. These techniques collectively make it challenging for forensic investigators to track, analyze, or attribute the attack.
- A. Correct.
Geo location refers to the use of geographically dispersed IP addresses (such as through VPNs) to hide the attacker's real location, making it harder to trace the origin of the attack. This technique is relevant in this scenario.
- B. Incorrect.
Obfuscation refers to techniques used to make data or actions unclear or difficult to understand. While encryption could be an example of obfuscation, it is not explicitly demonstrated in this scenario.
- C. Correct.
Evading detection involves bypassing monitoring systems, such as hiding activities by routing traffic through VPNs or encrypted channels. This technique is evident in the scenario.
- D. Correct.
Data destruction involves deleting or removing key artifacts, such as logs, to hinder forensic analysis. The scenario explicitly mentions the deletion of system logs, making this technique applicable.
- E. Incorrect.
Hindering forensics refers to deliberately interfering with an investigation, such as corrupting evidence. While related, this technique does not specifically match the actions described in the given scenario.