Unit 13-14

Question 1

What is one of the most common challenges when storing logs over long periods?

Accepted Answer

High storage cost

Question 2

Which component of Metasploit is responsible for launching attacks?

Accepted Answer

Exploits

Question 3

Which type of log in an operating system typically records login attempts and user activity?

Accepted Answer

Authentication logs

Question 4

Which Linux tool is commonly used as a firewall?

Accepted Answer

UFW

Question 5

What is the primary purpose of system logs in operating systems?

Accepted Answer

To track system events and errors

Question 6

Which hardware component stores data permanently, even when the system is powered off?

Accepted Answer

Hard Drive

Question 7

What does the Mitre ATT&CK framework primarily focus on?

Accepted Answer

Describing adversary tactics, techniques, and procedures (TTPs)

Question 8

What is the primary function of a firewall in cybersecurity?

Accepted Answer

To monitor network traffic and block unauthorized access

Question 9

Which of the following tools is included in the Windows Sysinternals suite?

Accepted Answer

Process Explorer

Question 10

Which of the following is used by Nmap to identify open ports on a host?

Accepted Answer

Port scan

Question 11

What is the primary purpose of the Windows Sysinternals suite?

Accepted Answer

To monitor system performance and diagnose issues

Question 12

What is the purpose of an Nmap Ping Scan?

Accepted Answer

To detect live hosts on a network

Question 13

What is the primary function of the Nmap tool?

Accepted Answer

Network mapping and vulnerability scanning

Question 14

What is Snort primarily used for in network security?

Accepted Answer

Intrusion detection and prevention

Question 15

What is the main purpose of CTI?

Accepted Answer

To analyze and mitigate potential cybersecurity threats

Question 16

Which tool is used to configure firewall rules on Linux systems, commonly in combination with UFW?

Accepted Answer

iptables

Question 17

What typically happens when log retention policies expire?

Accepted Answer

Logs are deleted or moved to a backup

Question 18

Which of the following is a category found in Windows Event Logs?

Accepted Answer

Application

Question 19

What is the primary function of rsyslog in log collection?

Accepted Answer

Collecting and forwarding log messages from various systems

Question 20

Which of the following is a commonly used tool for threat intelligence gathering?

Accepted Answer

TheHive

Question 21

Which of the following is a key component of the MITRE ATT&CK framework?

Accepted Answer

Techniques

Question 22

Which of the following is a common location for system logs on a Linux system?

Accepted Answer

/var/log/syslog

Question 23

What is the main purpose of using logrotate on a system?

Accepted Answer

To rotate, compress, and manage large log files

Question 24

What is one of the main features of threat intelligence tools like MISP (Malware Information Sharing Platform)?

Accepted Answer

Collecting and sharing indicators of compromise (IOCs)

Question 25

Which Nmap scan type is often used to avoid detection by firewalls or intrusion detection systems?

Accepted Answer

SYN Scan

Question 26

Why is it important to define retention policies for logs?

Accepted Answer

To ensure compliance with legal and regulatory requirements

Question 27

What is the primary goal of categorizing data sources in logs?

Accepted Answer

To better understand and manage log data from multiple sources

Question 28

Which component of the hardware is responsible for executing instructions in a computer system?

Accepted Answer

CPU

Question 29

Which Nmap command would you use to scan for open ports on a specific host?

Accepted Answer

nmap -sS <IP address>

Question 30

What is the primary use of the Metasploit Framework?

Accepted Answer

To develop and execute exploit code against remote systems

Question 31

Who developed the MITRE ATT&CK framework?

Accepted Answer

MITRE Corporation

Question 32

What is the default status of UFW (Uncomplicated Firewall) on most Linux distributions?

Accepted Answer

Disabled

Question 33

Which of the following is typically categorized as a source of log data?

Accepted Answer

All of the above

Question 34

Which of the following is a common challenge in implementing CTI?

Accepted Answer

Difficulty in managing large volumes of information

Question 35

Which of the following is typically used to configure logrotate settings?

Accepted Answer

/etc/cron.d/logrotate

Question 36

In Windows, what is typically logged under the "Security" log category?

Accepted Answer

Login attempts and access control events

Question 37

What is the last step in the CTI lifecycle?

Accepted Answer

Dissemination to relevant teams for action

Question 38

What is the main purpose of the CTI framework?

Accepted Answer

To provide actionable insights into the cybersecurity threat landscape

Question 39

In MITRE ATT&CK, how are adversary tactics and techniques mapped?

Accepted Answer

Using a matrix with rows for tactics and columns for techniques

Question 40

Which of the following is an example of semi-structured logs?

Accepted Answer

JSON logs

Question 41

What does CTI stand for in cybersecurity?

Accepted Answer

Cyber Threat Intelligence

Question 42

What is the purpose of interface recognition in MITRE ATT&CK?

Accepted Answer

To recognize and understand the interface used in an attack

Question 43

What is typically analyzed during the "Analysis" phase of the CTI lifecycle?

Accepted Answer

Raw threat data for actionable insights

Question 44

What does the /var/log/auth.log file typically store on a Linux system?

Accepted Answer

Authentication attempts and security events

Question 45

Which of the following is an important consideration when storing logs?

Accepted Answer

All of the above

Question 46

What is a key benefit of using CTI?

Accepted Answer

Enhancing threat detection and response

Question 47

Which of the following is the first step in the CTI lifecycle?

Accepted Answer

Collection

Question 48

Which configuration file is typically used to define rsyslog's behavior on a Linux system?

Accepted Answer

/etc/rsyslog.conf

Question 49

What is one of the main uses of the MITRE ATT&CK framework?

Accepted Answer

Adversary emulation

Question 50

What does the Nmap Script Scan (-sC) do?

Accepted Answer

It executes vulnerability scripts to detect weaknesses

Question 51

What is the purpose of the "tactics" in the MITRE ATT&CK framework?

Accepted Answer

To provide an overview of attack goals or objectives

Unit 13-14

Questions 51

Unit 13-14

Questions 51