I enter the query 'source="/var/log/apache2/access.log"', what am I doing?

Looking at the Apache access log

A defined query that can trigger email to SOC team

I want to collect Windows OS logs into Splunk. I need to...

Install universal forwarder service

I enter a query in Splunk. What am I doing?

Retrieving information from the Splunk SIEM

Why should SIEM generate alerts?

To flag potential suspicious events (incidents)

Event = June 20 07:00:22 Venus123 sshd[892]: Accepted password for root from 10.10.10.10 port 45811 ssh2

SSH connection established 06/20 with root as username

Log aggregation is about...

Collecting logs with similar structures

Which one contributes the most to IoT vulnerabilities?

Developers do not understand secure coding and security awareness

studbud

CIT 1

20 termsStudBud Administration36 plays

Imported from external platform

Flashcards20 cardsFPractice quizPHost liveL

Questions 20

Answers

1
I enter the query 'source="/var/log/apache2/access.log"', what am I doing?
Looking at Apache error log
Query makes no sense
Looking at Windows access log
Looking at the Apache access log
2
Which technology uses a decoy to lure attackers?
Firewall
IPS
DDoS
Honeypot
3
Antivirus uses which of the following approach to detect malware?
Strings
Heuristics
All of the above
Hashes
4
A Splunk alert is...
Alerts by default are incidents
An alert that a forwarder is not working
Splunk does not support alerts
A defined query that can trigger email to SOC team
5
I want to collect Windows OS logs into Splunk. I need to...
First convert Windows logs to look like Linux logs
Install universal forwarder service
Install Syslog for Windows
Nothing. Splunk already recognized Windows logs
6
I want to download a legitimate file from a website, but my browsers blocks it. This is a:
False Negative
False Positive
True Positive
True Negative
7
Which one below is NOT an endpoint security control?
Web application firewall
Antivirus
Host firewall
Endpoint Detection and Response
8
Which commands do I use for an email spoofing attack?
EHLO, MAIL FROM, RCPT TO
HELO, MAIL FROM, RCPT TO
HELO, FROM, TO
HELLO, MAIL FROM, RCPT TO
9
I enter a query in Splunk. What am I doing?
Configuring Splunk
There is no such thing as query(s) in Splunk
Retrieving information from the Splunk SIEM
Creating a Splunk alert
10
Why should SIEM generate alerts?
Generate an alert for every event received by the SIEM
To flag potential suspicious events (incidents)
Application configuration is incorrect
Monitor what users are doing
11
I want to learn new cyber attacks. What can I deploy to learn new attacks?
Honeypot
Antivirurs
IPS/IDS
Pentesting
12
Why create Splunk alerts?
Monitor ransomware attacks
Monitor phishing attacks
Investigate suspicious events
monitor ONLY what employees do
13
What is the main purpose of SIEM?
Detect incidents
Detects only email attacks
Collects logs
Protect applications
14
What is DomainKeys Identified Mail (DKIM)?
Same as MX record
Uses IP addresses of authorized email servers
Email validation technique
Mail security server
15
What is considered the weakest link in security?
Improper configuration of honeypot
Stale antivirus signatures
Unpatched server
[Untrained] people
16
PfSense is primarily a...
IDS/IPS
Open-source firewall
Antivirus solution
DHCP Server
17
Event = June 20 07:00:22 Venus123 sshd[892]: Accepted password for root from 10.10.10.10 port 45811 ssh2
Machine 10.10.10.10 is logging in as admin via SSH
Machine Venus123 using root to login via SSH
SSH connection established 08:00 with a root as username
SSH connection established 06/20 with root as username
18
Log aggregation is about...
Collecting logs from one type of security control
Collecting logs with similar structures
Determining which logs to keep and discard
Logs that come with incidents
19
DLP does not have to be used for which item below?
Software code deemed intellectual property
An email with PII
A file with public information
Database with customer information, including name and address
20
Which one contributes the most to IoT vulnerabilities?
IoT devices on their own network
Developers do not understand secure coding and security awareness
IoTs are not vulnerable
Not having a security manager on site

CIT 1 Flashcards | StudBud