01Session plan
| Minutes | Block | What happens |
|---|---|---|
| 0–10 | Brief and rules | Read the scenario aloud. State the four rules that decide most answers: verify first, write the time basis next to every time, name a host only through the lease valid at that moment, and keep a log's record apart from a person's act. |
| 10–30 | Integrity and the message (Q1–Q3) | Hash check first, then both body parts of the message. Compare the displayed link text with the href, and read the authentication results for what they name. |
| 30–60 | Three clocks (Q4, Q5, Q7) | Convert the proxy times and the header times to UTC, then place the DNS query, the request and the delivery on one line. |
| 60–85 | The host, the counts and the limits (Q6, Q8–Q12) | Find the lease valid at the moment, explain the gap between queries and requests, and say what a tunnel row does and does not record. |
| 85–100 | Completeness and the signed sentence (Q13, Q14) | Decide whether the export is whole, then have each trainee write the one finding they would sign and one sentence they would not. |
Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →
02Answer key
Q011 point
On a copy of proxy-log.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.
Answerd5bcf623
The prefix matches the manifest line for proxy-log.csv. Integrity is checked before the file is read, so that every later finding can be tied to the bytes that were examined.
- Where
- manifest.txt, the proxy-log.csv line; recompute with sha256sum or another SHA-256 tool.
- Usual mistake
- Opening the CSV in a spreadsheet application and saving it, which rewrites the bytes and changes the hash.
Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration
Q021 point
Read the HTML part of phishing-message.eml. To which domain does the link really point (the href), as opposed to the domain written as the link text?
Answerlinden-print-sso.example
The link text reads https://hr.linden-print.example/leave-policy, a name inside the company's own domain. The href points to linden-print-sso.example, and the plain-text part shows the same address. The value id=7f3a at the end of the address is what ties the message to the first request in the proxy log.
- Where
- phishing-message.eml, the text/html part and the text/plain part; proxy-log.csv, the row at 10:31:06.
- Usual mistake
- Trusting the text a link displays, or reading only the plain-text part and never comparing it with the HTML part.
Q032 points
The Authentication-Results line of phishing-message.eml records spf=pass, dkim=pass and dmarc=pass. What do these results establish?
AnswerB — That each check passed for linden-hr-notice.example, the sender's own domain. They show that the controller of that domain sent the message. They do not show that it is legitimate or that it came from Linden.
RFC 8601 defines Authentication-Results as the record of the checks made by the named service, here mx.linden-print.example. The SPF domain, the DKIM domain and the From domain are all linden-hr-notice.example, so the checks agree with each other. That is a statement about that domain. Anyone who registers a name that resembles a company's and configures it correctly gets three passes.
- Where
- phishing-message.eml, the Authentication-Results line and the From line.
- Usual mistake
- Reading pass as a sign of trust. In VP-03 the same line recorded a fail; here it records passes, and neither says who wrote the message.
Q042 points
In dns-log.csv, at what UTC time did 192.0.2.37 first ask for an A record of linden-print-sso.example? Enter it as YYYY-MM-DD HH:MM:SS.
Answer2026-04-07 07:31:05
The column time_utc is UTC. The query comes one second before the first request for the same name in the proxy log, which is written in local time (10:31:06). A client has to resolve a name before it can connect to it.
- Where
- dns-log.csv, the first A row for linden-print-sso.example from 192.0.2.37.
- Usual mistake
- Taking the first proxy row for the domain, 10:31:06, as the first contact. It is local time, and the lookup came before it.
Q052 points
How many seconds passed between that DNS query and the first request for the same domain in proxy-log.csv? Enter a whole number.
Answer1
export-metadata.txt states that time_local is UTC+3. The first request, 10:31:06 local, is 07:31:06 UTC. The query is at 07:31:05 UTC. The difference is one second. Subtracted without conversion, the two values differ by 10,801 seconds, which is three hours and one second.
- Where
- proxy-log.csv, the row at 10:31:06; dns-log.csv, the query at 07:31:05; export-metadata.txt, the time_local line.
- Usual mistake
- Subtracting the UTC query time from the local request time, which gives a difference of about three hours.
Q061 point
Which host name held 192.0.2.37 at the moment of that first request, according to dhcp-leases.csv?
AnswerLPW-HR02
The first request is at 07:31:06 UTC. That moment lies inside the lease of LPW-HR02, 06:30:04 to 08:30:30 UTC. The same address was leased to LPW-OPS07 earlier that morning and to LPW-FIN04 later.
- Where
- dhcp-leases.csv, the three rows for 192.0.2.37; proxy-log.csv, the row at 10:31:06.
- Usual mistake
- Matching the local proxy time, 10:31:06, against the UTC lease times. That lands in the lease of LPW-FIN04 and names the wrong host.
Q072 points
How many seconds passed between the message reaching the mailbox server (the top Received line of phishing-message.eml) and the first request in the proxy log? Enter a whole number.
Answer1103
The top Received line reads 10:12:43 +0300, which is 07:12:43 UTC. The first request is at 07:31:06 UTC. The difference is 18 minutes and 23 seconds, which is 1,103 seconds. Both times have to be in UTC before they are subtracted.
- Where
- phishing-message.eml, the first Received line; proxy-log.csv, the row at 10:31:06.
- Usual mistake
- Using the Date header, which the sender wrote, instead of the delivery line, or subtracting a +0300 value from a value that has been converted.
Q081 point
How many A queries for linden-print-sso.example from 192.0.2.37 does dns-log.csv contain? Enter a whole number.
Answer2
There are two A queries, at 07:31:05 and 07:52:15 UTC. The two AAAA lines are a different query type, answered without an address. Together the lines for this name number four, but only the A lines are asked for here.
- Where
- dns-log.csv, the rows with qtype A, query linden-print-sso.example and client 192.0.2.37.
- Usual mistake
- Counting the AAAA lines as well, or counting the four proxy rows.
Q092 points
The proxy log has four requests to linden-print-sso.example from 192.0.2.37, but the DNS log has two A queries. Which explanation fits the files?
AnswerD — The answer had a TTL of 300 seconds. The first three requests, 07:31:06 to 07:31:41 UTC, fall inside it, so no new query reached the resolver. The fourth, at 07:52:16 UTC, came after the answer had expired and follows a new query at 07:52:15.
The ttl column holds 300 for this name. The first answer, given at 07:31:05, is valid until 07:36:05. export-metadata.txt says that a client holding a valid answer sends no new query. A log that shows fewer queries than requests is therefore expected. The count of queries is not the count of connections.
- Where
- dns-log.csv, the ttl column and the four rows for this name; proxy-log.csv, the four rows for this name; export-metadata.txt, the scope of the DNS export.
- Usual mistake
- Expecting one DNS query for each request.
Q102 points
What does the proxy log show about the connection at 10:31:41 local time, CONNECT linden-print-sso.example:443?
AnswerC — That a client at 192.0.2.37 opened an encrypted connection to that host and port at that time, and how many bytes moved in each direction. It does not show the page, the form fields or what was typed.
For CONNECT the target holds only host and port, and the proxy does not decrypt HTTPS. The byte counts cover the whole tunnel. A tunnel of a few kilobytes is consistent with a form being sent, and it is equally consistent with other uses. The size is not a finding about content.
- Where
- proxy-log.csv, the row at 10:31:41; export-metadata.txt, the lines for the columns target, bytes_out and bytes_in.
- Usual mistake
- Reading the size of a tunnel as proof of what was sent.
Q111 point
How many bytes did the client send (bytes_out) in the CONNECT to linden-print-sso.example at 10:31:41? Enter a whole number.
Answer3917
The row records bytes_out 3917 and bytes_in 5206. bytes_out counts what the client sent and bytes_in what the server sent, both over the whole tunnel. Read the column name before you read the number.
- Where
- proxy-log.csv, the row at 10:31:41, the bytes_out column.
- Usual mistake
- Reading bytes_in, or adding the two columns.
Q122 points
The proxy log has a row from 192.0.2.37 at 11:34:20 local time (GET http://news.daily-gazette.example/world/today). Whose activity is it?
AnswerA — LPW-FIN04. At 08:34:20 UTC the address was leased to LPW-FIN04, and the lease of LPW-HR02 ended at 08:30:30 UTC. The row is not evidence about the HR assistant's workstation.
The proxy time converts to 08:34:20 UTC. LPW-HR02's lease ends at 08:30:30 and the lease of LPW-FIN04 begins at 08:30:41. An address identifies a host only for the span of one lease. The same address means the same host only until the lease changes.
- Where
- proxy-log.csv, the row at 11:34:20; dhcp-leases.csv, the rows for 192.0.2.37.
- Usual mistake
- Attributing every row of one address to one host for the whole day.
Q132 points
Is proxy-log.csv complete for its window, 10:00 to 14:00 local time? Choose the statement that is true.
AnswerD — No. 40 rows were returned at a row limit of 40, a next page exists and was not collected, and the last row is at 12:05:17. The file says nothing about 12:05:17 to 14:00:00 local time, and the lack of later rows is not evidence that nothing happened.
The metadata gives the row limit (40), the rows returned (40) and a next page that was not collected. A page that fills its limit is a reason to ask for the next page, not a reason to treat the export as whole. In VP-03 the export stopped well below its limit and could be called complete; this one cannot.
- Where
- export-metadata.txt, Export 1: row limit, rows returned and next page; proxy-log.csv, the last row.
- Usual mistake
- Treating a full page as the whole result.
Q142 points
Which sentence could the examiner sign from these files alone?
AnswerC — On 7 April 2026 a client at 192.0.2.37, leased at that moment to LPW-HR02, requested the domain named in the message link 18 minutes after delivery (07:31:06 UTC, after a DNS query at 07:31:05 UTC), and made three more requests to it, the last at 07:52:16 UTC. The files do not show who used the workstation, what was typed, or whether the account was used elsewhere.
Sentence c states the time basis, the host at that moment, the counts, and the limits. Sentences a and b state what the logs cannot show. Sentence d discards what the files do record.
- Where
- All four data files; each fact in sentence c comes from one of them.
- Usual mistake
- Filling the gap between a log line and a person with an inference and signing it as a finding.
03Reconstructed timeline
The timeline as the correct answers build it. Local time is UTC+3.
| UTC | Local | Event | Source |
|---|---|---|---|
| 06:30:04 | 09:30:04 | The lease of 192.0.2.37 to LPW-HR02 begins. Earlier that morning the address belonged to LPW-OPS07. | dhcp-leases.csv |
| 07:31:05 | 10:31:05 | First A query from 192.0.2.37 for linden-print-sso.example, answered with a TTL of 300 seconds. The proxy log shows the first request one second later, at 10:31:06 local time. | dns-log.csv |
| 07:52:15 | 10:52:15 | Second A query for the same name, after the first answer expired. The fourth proxy request follows at 10:52:16 local time. | dns-log.csv |
| 08:30:41 | 11:30:41 | The address is leased to LPW-FIN04. Later proxy rows from 192.0.2.37 do not describe the HR workstation. | dhcp-leases.csv |
04Scoring
Questions 1–11 carry one point each and question 12 carries three: 23 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.
| Points | Next step |
|---|---|
| 20–23 | Sound. Move on to a supervised review of a real proxy export, or to VP-03 if you have not done it. |
| 12–19 | Review each missed question with its explanation and its linked records, then derive Q5, Q7 and Q12 again from the files. |
| 0–11 | Work through the time-basis and network-log modules first, then repeat the pack from the start. |
Finding paragraph: criteria
- ☐ Every time carries its basis: UTC, or local time with its offset.
- ☐ The host is named through the lease valid at that moment, and the report names the host, not a person.
- ☐ The report states what the logs do not show: who used the workstation, what was typed, and the period after the last row of the proxy export.
- ☐ Each claim names its file and row, and the report says that the proxy export is incomplete.
05Debrief
- A link's displayed text is written by the sender. The href is what the browser follows.
- Authentication results describe the domain they name. A pass for a look-alike domain is not trust.
- Two logs, two clocks. Convert before you subtract.
- An address names a host only for the length of a lease. A full page of an export is a reason to ask for the next page.
06Model finding
The message phishing-message.eml was handed to the mailbox server at 07:12:43 UTC. The link in its HTML part points to linden-print-sso.example, not to the company domain shown as the link text. SPF, DKIM and DMARC passed for linden-hr-notice.example, the sender's own domain. At 07:31:05 UTC, 18 minutes 22 seconds after delivery, the client at 192.0.2.37 asked the resolver for that name; the proxy log shows a request one second later and three more connections, the last at 07:52:16 UTC. The lease records show that at that moment the address belonged to LPW-HR02, and that from 08:30:41 UTC it belonged to LPW-FIN04, so later rows from the address are not about the HR workstation. The proxy log records the destination and the size of each tunnel, not what was typed. It is also incomplete: it stopped at its row limit of 40, at 12:05:17 local time, and a next page was not collected. The pack does not show who used the workstation, whether a password was entered, or whether the account was used elsewhere; the mail service's sign-in logs are the next source to ask for.