An analyst is investigating an incident in a SOC environment. Which method is used to identify a session from a group of logs?
A) sequence numbers
B) IP identifier
C) 5-tuple
D) timestamps

Question

Quizplus · Accepted Answer

The 5-tuple method, which includes source IP, destination IP, source port, destination port, and protocol, is commonly used to uniquely identify a session in network logs.

An Analyst Is Investigating an Incident in a SOC Environment