Module 5 SIEM Introduction

Question 1

What is true about SIEM for Security ( Select all possible answers )

Accepted Answer

Provides data analysis, Log collection software and log retention, Security incident alerts based on logs

Question 2

What is Search Head?

Accepted Answer

An interface used to search and access data.

Question 3

Splunk Forwarder should be installed separately (on Linux, Windows, or Mac).

Accepted Answer

True

Question 4

A SOC is responsible for detecting and protecting against cybersecurity threats.

Accepted Answer

True

Question 5

What are some Application Logs ( Select all that apply) ( Double Points )

Accepted Answer

WAF, DB, FIREWALL, IPS

Question 6

What are two Splunk Plugins?

Accepted Answer

Add-on, Apps

Question 7

What provides near real-time alerts, investigations, provide evidence, provide risk management for corporate assets.

Accepted Answer

SIEM

Question 8

Collectors don't forward logs received from OSs and applications to the SIEM.

Accepted Answer

False

Question 9

What is Snort?

Accepted Answer

An open-source IDS/IPS system

Question 10

What are some Event Log Classification?

Accepted Answer

Information Logs, Success Audit, Failure Audit, Error Logs, Warnings

Question 11

Some Linux distributions have tools to view the logs graphically.

Accepted Answer

True

Question 12

UNIX systems usually save logs in the /var/log directory.

Accepted Answer

True

Question 13

Splunk can't be installed on any OS.

Accepted Answer

False

Question 14

In a Debian-based OS, Splunk is installed with the package manager.

Accepted Answer

True

Question 15

Log Collector is typically located in every environment

Accepted Answer

True

Question 16

Add-on Is typically a single component that can be reused in different use cases

Accepted Answer

True

Question 17

To send logs from DMZ to LAN, specific ports must be opened.

Accepted Answer

True

Question 18

What are some Cybersecurity Threats? ( Select all that apply )

Accepted Answer

Vulnerability, Threat, Risk

Question 19

Syslog can use TCP/UDP when the default port is 514.

Accepted Answer

True

Question 20

Which ones of the following are Security Components?

Accepted Answer

Firewall, Identity Management, Network Access Control, Network Behavior Analysis, Endpoint Protection Security, Intrusion Detection and Prevention, Web Application Firewall, Mail Relay

Question 21

Select all possible answer of Windows Event Logs

Accepted Answer

System, Application, Security, Setup

Question 22

Why SIEM Is Important ( Select 2 )

Accepted Answer

Creates reports of suspicious activities, Helps detect security incidents at an early stage

Question 23

Snort is not supported by pfSense

Accepted Answer

False

Question 24

Snort can Can perform real-time network traffic analysis

Accepted Answer

True

Question 25

Some applications use files to write logs.

Accepted Answer

True

Question 26

The Splunk Windows installation follows steps that are similar to a Linux installation.

Accepted Answer

True

Question 27

SIEM logs in to the database and extracts logs according to a predefined query.

Accepted Answer

True

Question 28

A NOC is tasked with ensuring that an organization IT infraestructure continues to function properly

Accepted Answer

True

Question 29

What are some Unix Log Sources ( Select all possible answers ) ( Double points )

Accepted Answer

IPtables, Auth.log, Syslog, Apache2

Question 30

Mac uses Console.app, which is similar to the Windows Event Viewer.

Accepted Answer

True

Question 31

In Windows, logs can be viewed in Event Viewer.

Accepted Answer

True

Question 32

Some popular SIEMs include: ( Select all possible answers )

Accepted Answer

Splunk, AlienVault, ArcSight, QRadar

Module 5 SIEM Introduction

Questions 32

Module 5 SIEM Introduction

Questions 32