At a manufacturer, grouped logs show every workstation querying the same internal DNS address. One workstation also opens TCP port 445 to many plant servers. Which set of tuples is the compromise lead?
Select an answer to reveal the explanation.
Short Explanation
If every employee uses the same cafeteria, the cafeteria is not the suspect. You follow the one workstation opening TCP 445 to many plant servers. The trap is the DNS resolver everyone queries, the gateway that only forwards, or the time server.
Full Explanation
The 5-tuple that stands out is the one that is not shared. Every workstation queries the same internal DNS address, so that pattern is normal plant name resolution. One workstation also opens TCP 445, the SMB port, toward many plant servers. That repeated server-message-block pattern is the compromise lead. "The workstation SMB tuples, TCP port 445 from one host toward many plant servers" identifies the odd host. "The shared internal DNS tuples, the resolver address that every workstation already queries" point at a service everyone uses and do not single out a host. "The plant gateway address, the forwarder that carries sessions but is not the odd host" appears because traffic is forwarded, not because the gateway is the actor. "The NTP server address, a time source that does not explain the spread of SMB sessions" is unrelated to the port 445 pattern. Exam caveat: TCP 445 is ordinary file sharing, and the lead is one host opening it toward many servers while DNS stays common. Operational check: group the flows by source address and destination port, then compare the SMB source with the hosts that only query DNS.