Free ECCouncil 112-57 Practice Exam with Questions & Answers | Set: 3

In the TCP/IP model, theTransport layeris responsible forend-to-end communication between peer entitieson the source and destination systems. “Peer entities” here refers to the corresponding transport components (and the applications that use them) on two different hosts communicating across a network. This layer forms the practical “backbone” of host-to-host data flow because it provides the mechanisms that allow data to be deliveredfrom one endpoint process to another endpoint processreliably or efficiently, depending on the protocol used.

The Transport layer includes protocols such asTCPandUDP. TCP supports connection-oriented communication with sequencing, acknowledgments, retransmissions, and flow control—features that are fundamental when reconstructing sessions during network forensic investigations (e.g., rebuilding a file transfer or a web session). UDP provides connectionless delivery used by many services where speed is preferred over guaranteed delivery, which is also significant in investigations of DNS, streaming, or certain malware communications.

By contrast, theInternet layerfocuses on logical addressing and routing (IP), theNetwork access layerhandles local delivery on the physical/link network, and theApplication layerprovides user-facing protocols. Therefore, the layer enabling peer communication between endpoints is theTransport layer (C).

In event correlation (as applied in SOC/SIEM-driven investigations), the workflow typically starts byreducing complexityandnormalizing what “one incident” looks likebefore attempting conclusions about causality.Event aggregation (2)is performed early to combine multiple low-level, related events (for example repeated authentication failures, repeated firewall denies, or multiple IDS hits for the same signature) into higher-level “grouped” records. This prevents analysts from treating every raw log line as a separate incident and makes correlation computationally and operationally feasible.

Next,event masking (1)suppresses events that are already known to be irrelevant or repetitive in a way that does not add investigative value (for example, routine scheduled scans, approved admin tools, or duplicate alerts already represented in the aggregated set). After masking,event filtering (4)further removes remaining noise using rules, thresholds, whitelists, time windows, or relevance criteria (scope, asset criticality, and known-benign sources), leaving a cleaner dataset that represents probable security-relevant activity.

Only after the dataset is consolidated and noise-reduced doesroot cause analysis (3)become reliable, because RCA depends on a clear chain of correlated events to identify the initiating action and propagation path. Hence the correct sequence is2 → 1 → 4 → 3 (Option B).