Network Security II - Chapter 12 Review

Where disruption is the goal, what type of attack would this be classified as?

Preferred method for analyzing applications designed to circumvent firewalls?

In Sguil, The classification assigned to the event.

A breach is successful without being detected. What condition describes the lack of alert?

Which method has events create an inevitable result of antecedent?

Which tool would an analyst use to start a workflow investigation?

In Sguil, The IP protocol type of the packet.

Refer to the exhibit. Which source port is used by the host to request the download?

What is threat attribution in a basic DoS attack?

In Sguil, The human readable name of the event.

A compromised server was removed & preserved the security hack. What type of evidence is this?

When gathering evidence, which is the most volatile data?

In a breach where disruption was the goal using a basic tool, how would you classify the actor?

According to NIST, which step involves extracting relevant information from data?

Which type of evidence supports an assertion based on previously obtained evidence?

What procedure should be avoided in a digital forensics investigation?

Which tool, included with Security Onion, is used by Snort to automatically download new rules?

Which two strings will be matched by the regular expression? Level[^12] (2 correct)

Which term is used to describe the process of converting log entries into a common format?

Which tool has alert records linked directly to the searches of ELSA?

How does an application program interact with the operating system?

What are the core functions provided by the Security Onion? (2 correct)

Which Cisco tool provides a dashboard that allows investigation of the threat landscape?

Which statement describes the status after the Security Onion VM is started?

How is the hash value of files useful in network security investigations?

What are three common tools used to carry out a DoS attack? (2 correct)

Which statement describes a feature of timestamps in Linux?

Refer to the image. What is the function provided by the ampersand symbol used in the command?

Which tool is a Security Onion integrated host-based intrusion detection system?

In Sguil, The unique ID of the sensor.

What is indicated by a Snort signature ID that is below 3464?

Refer to the exhibit. The transaction data seems indecipherable. What is the explanation?

Which procedures in Sguil are provided to security analysts to address alerts? (2 correct)

Refer to the exhibit. How is the current view sorted?

Which types of unreadable traffic could be eliminated from data collected by NSM? (2 correct)

When gathering evidence, which is the least volatile data?

Which method is precise & yields the same result every time using predefined conditions?