CIT 07 + Book 3

Question 1

True about alerts (mark ANY correct):

Accepted Answer

Message about possible anomaly/threat/attack, based on predefined criteria, Sent via email, SNMP, syslog, scripts or directly to management systems

Question 2

When using ACLs, all the rules must be checked before the action is taken.

Accepted Answer

False

Question 3

You are aggregating alerts when you consolidate logs with identical content in predefined fields and specific frames.

Accepted Answer

True

Question 4

A SOAR stack is based on playbooks that contain actions to be taken upon detection of specific events.

Accepted Answer

True

Question 5

NAC is normally implemented using all of these, EXCEPT which one?

Accepted Answer

Domain

Question 6

SOAR stands for:

Accepted Answer

Security Orchestration, Automation and Response

Question 7

The computers that serve as a point of access for external users to access protected pars of the Network is called:

Accepted Answer

Jump Server

Question 8

Alerts are never based on more than one events.

Accepted Answer

False

Question 9

SOAR increases the money spent just a little because:

Accepted Answer

It doesn't increase the cost, but reduces it.

Question 10

One of the characteristics for Incident Case Management is that cases are opened and closed without human intervention.

Accepted Answer

True

Question 11

You are checking the ACLs in your router. Which port should not be there as allowed?

Accepted Answer

TCP 23

Question 12

A Playbook cannot be customized to add a human decision at critical decision-making points.

Accepted Answer

False

Question 13

Alert correlation indicates that similar friendly behavior among various system products.

Accepted Answer

False

Questions 13