DFIR-09 Log Analysis & Timeline

Question 1

provide real-time analysis of alerts and log entries

Accepted Answer

SIEMs

Question 2

Which of these can you not see in Windows logs in the Event Viewer?

Accepted Answer

Syslogs

Question 3

What would a Perpetrator attack when attacking a log file? (Click all that apply)

Accepted Answer

Transmitted logs, The host in which logs are generated, Database in which logs are stored, Agents that collect logs

Question 4

Which directory is commonly used on Linux systems to store log files, including syslog and apache access logs?

Accepted Answer

/var/log

Question 5

Which of the following lists are log analysis tools?

Accepted Answer

MS Log Parser,Lizard and Evt Log Viewere.

Question 6

What is the Windows Registry?

Accepted Answer

all of the above

Question 7

You can view audit logs in the Event Viewer.

Accepted Answer

True

Question 8

Linux Log File Contents of Boot message data are located...

Accepted Answer

/var/log/boot.log

Question 9

Linux Log File Contents of Global system messages are located...

Accepted Answer

/var/log/messages

Question 10

In Security.evtx - If you see a 4624 followed by 4672 is suspect because...

Accepted Answer

user Successfully logged on & then promoted to "administrator equivalent"

Question 11

Linux Log File Contents of Data logged by the kernel are located...

Accepted Answer

/var/log/kern.log

Question 12

In a Windows event log, what are the levels of severity?

Accepted Answer

Information, warning, error and critical

Question 13

In cybersecurity a "RAT" means

Accepted Answer

Remote Access Trojan

Question 14

Microsoft word crashes, what will the Windows event log perform?

Accepted Answer

Create log entry about the issue, app.name n why it crashed

Question 15

In a Windows event log, what are the levels of severity?

Accepted Answer

Information, warning, error and critical

Question 16

Linux Log File Contents of Active Cron job data are located...

Accepted Answer

/var/log/cron

Question 17

The challenge of log management relates to (Click all that apply):

Accepted Answer

Multiple devices generating logs, Very large volume of data, Different log formats

Question 18

In Security.evtx - If you see a 4688 with a TokenElevationType is suspect because...

Accepted Answer

New process generated with a elevated privilege to do a credential dump

Question 19

In Security.evtx - If you see a 5140 is suspect because...

Accepted Answer

Shows a Share has been Mounted

Question 20

Domain controller – event logs are unreliable, for the limited space makes the log overwrite anything over 8 hours or so

Accepted Answer

True

Question 21

what are three types of event logs ?

Accepted Answer

application, system, security

Question 22

In TaskSchedulerOperational.evtx If you see a 106 immediately followed by 200 is suspect because...

Accepted Answer

Task was Scheduled then immediately Executed Sucessfully

Question 23

Which Security and Information Event Management (SIEM) product helps with the analysis and reporting of security events?

Accepted Answer

Correlation

DFIR-09 Log Analysis & Timeline

Questions 23

DFIR-09 Log Analysis & Timeline

Questions 23