Proxy, DNS and DHCP logs: one click on a phishing link

01Brief

Linden Print Works Ltd. prints packaging. On Tuesday 7 April 2026 the mailbox e.sahin@linden-print.example, used by a human resources assistant, received a message headed "Updated leave policy: confirm your details". The assistant told the IT desk that they opened the link in it and could not remember whether they typed anything. The IT administrator exported the web proxy log for four hours of the morning, the DNS resolver log and the DHCP leases, and saved the raw message. The proxy export stopped at its row limit. The sign-in logs of the mail service are not part of the pack.

Internal audit asks:

1. Where does the link in the message really point, and did a request to that destination follow?
2. Which host held the client address at that moment?
3. What can the proxy log not show, and is it complete?

Answer from the files only: what the message, the logs and the leases record, and what they cannot show. Do not decide who used the workstation, what was typed, or whether the account was used elsewhere.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Work on copies. Write the time basis next to every time you copy out of a file, and convert to UTC before you compare two sources.
• An IP address names a host only at a given moment. Use the lease record that was valid at that moment, in UTC.
• A log records that a request or a lookup happened. It does not record who was at the keyboard or what was typed.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 14 questions, 23 points.

1. Q011 pointproxy-log.csvmanifest.txt

   On a copy of proxy-log.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.8 hex characters
   Check

2. Q021 pointphishing-message.eml

   Read the HTML part of phishing-message.eml. To which domain does the link really point (the href), as opposed to the domain written as the link text?A domain name, as written in the href
   Check

3. Q032 pointsphishing-message.eml

   The Authentication-Results line of phishing-message.eml records spf=pass, dkim=pass and dmarc=pass. What do these results establish?

   AThat the message is legitimate and came from Linden's human resources department.BThat each check passed for linden-hr-notice.example, the sender's own domain. They show that the controller of that domain sent the message. They do not show that it is legitimate or that it came from Linden.CNothing, because DKIM and DMARC results are decorative.DThat the three results cancel each other out, so nothing can be said about the sender.
   Check

4. Q042 pointsdns-log.csv

   In dns-log.csv, at what UTC time did 192.0.2.37 first ask for an A record of linden-print-sso.example? Enter it as YYYY-MM-DD HH:MM:SS.YYYY-MM-DD HH:MM:SS, UTC
   Check

5. Q052 pointsdns-log.csvproxy-log.csvexport-metadata.txt

   How many seconds passed between that DNS query and the first request for the same domain in proxy-log.csv? Enter a whole number.A whole number of seconds
   Check

6. Q061 pointdhcp-leases.csvproxy-log.csvexport-metadata.txt

   Which host name held 192.0.2.37 at the moment of that first request, according to dhcp-leases.csv?A host name, as written in the file
   Check

7. Q072 pointsphishing-message.emlproxy-log.csvexport-metadata.txt

   How many seconds passed between the message reaching the mailbox server (the top Received line of phishing-message.eml) and the first request in the proxy log? Enter a whole number.A whole number of seconds
   Check

8. Q081 pointdns-log.csv

   How many A queries for linden-print-sso.example from 192.0.2.37 does dns-log.csv contain? Enter a whole number.A whole number
   Check

9. Q092 pointsdns-log.csvproxy-log.csv

   The proxy log has four requests to linden-print-sso.example from 192.0.2.37, but the DNS log has two A queries. Which explanation fits the files?

   AThe resolver lost two queries, so the DNS log cannot be used for this name.BTwo of the proxy rows are not genuine and the file was edited.CThe AAAA queries account for the missing two.DThe answer had a TTL of 300 seconds. The first three requests, 07:31:06 to 07:31:41 UTC, fall inside it, so no new query reached the resolver. The fourth, at 07:52:16 UTC, came after the answer had expired and follows a new query at 07:52:15.
   Check

10. Q102 pointsproxy-log.csvexport-metadata.txt

    What does the proxy log show about the connection at 10:31:41 local time, CONNECT linden-print-sso.example:443?

    AThat the user typed a password into a form on that site.BThe page address and the submitted data, in readable form.CThat a client at 192.0.2.37 opened an encrypted connection to that host and port at that time, and how many bytes moved in each direction. It does not show the page, the form fields or what was typed.DNothing, because CONNECT rows are not evidence.
    Check

11. Q111 pointproxy-log.csv

    How many bytes did the client send (bytes_out) in the CONNECT to linden-print-sso.example at 10:31:41? Enter a whole number.A whole number of bytes
    Check

12. Q122 pointsproxy-log.csvdhcp-leases.csvexport-metadata.txt

    The proxy log has a row from 192.0.2.37 at 11:34:20 local time (GET http://news.daily-gazette.example/world/today). Whose activity is it?

    ALPW-FIN04. At 08:34:20 UTC the address was leased to LPW-FIN04, and the lease of LPW-HR02 ended at 08:30:30 UTC. The row is not evidence about the HR assistant's workstation.BLPW-HR02, because it used the address earlier that day.CBoth hosts at once, because an address is shared.DIt cannot be said, because the DHCP export has no times.
    Check

13. Q132 pointsexport-metadata.txtproxy-log.csv

    Is proxy-log.csv complete for its window, 10:00 to 14:00 local time? Choose the statement that is true.

    AYes. It has 40 rows and the window is four hours.BYes. The metadata lists no error.CIt cannot be judged, because the export does not state a row limit.DNo. 40 rows were returned at a row limit of 40, a next page exists and was not collected, and the last row is at 12:05:17. The file says nothing about 12:05:17 to 14:00:00 local time, and the lack of later rows is not evidence that nothing happened.
    Check

14. Q142 pointsphishing-message.emlproxy-log.csvdns-log.csvdhcp-leases.csv

    Which sentence could the examiner sign from these files alone?

    AThe HR assistant entered their password on a fake sign-in page at 10:31:41, and an attacker used it.BThe message came from an attacker's server, so the proxy log proves that the mailbox account was compromised.COn 7 April 2026 a client at 192.0.2.37, leased at that moment to LPW-HR02, requested the domain named in the message link 18 minutes after delivery (07:31:06 UTC, after a DNS query at 07:31:05 UTC), and made three more requests to it, the last at 07:52:16 UTC. The files do not show who used the workstation, what was typed, or whether the account was used elsewhere.DNo sentence can be signed, because logs are not evidence.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis: UTC, or local time with its offset.
• The host is named through the lease valid at that moment, and the report names the host, not a person.
• The report states what the logs do not show: who used the workstation, what was typed, and the period after the last row of the proxy export.
• Each claim names its file and row, and the report says that the proxy export is incomplete.

How findings are phrased →