What is the main purpose of the SIEM solution?

Helps detect security incidents

An attacker launches a mail spoofing attack. Which of the following commands will probably be used in the attack?

HELO server, MAIL FROM:admin@domain.com, RCPTTO:IT@anotherDomain.com,data

What is the definition of an alert?

Query that checks rules for each log. Match results in alerts

Why should alerts be generated?

To monitor and handle suspicious events

What is the definition of log aggregation?

Collecting logs with similar structures

Why is defense in layers important?

Multiple layers of defense have a better chance of thwarting intruders

Why are IoT devices known to be vulnerable to many attacks?

Because of a lack of security awareness among developers.

May 21 07:41:22 pcx02 sshd[703]: Accepted password for root from 10.10.1.1 port 55811 ssh2.

An SSH connection was established on 05/21 with a root username.

What is the purpose of a log query?

To retrieve information from SIEM

studbud

CIT Exam

20 termsStudBud Administration53 plays

Imported from external platform

Flashcards20 cardsFPractice quizPHost liveL

Questions 20

Answers

1
What is considered the weakest link in cybersecurity?
Unaware and untrained people
Unpatched or outdated security controls
Unreviewed security logs
Improper implementation of anti-malware software
2
What is the main purpose of the SIEM solution?
Helps detect security attacks only on the email service
Helps detect security incidents
Protects open ports
Replaces the need for an AV application
3
Which of the following security measures is related to Endpoint Security?
Data Recovery
Processes and Threads
Cloud
Anti-virus
4
Microsoft Security Essentials was tagged in 2011 Google Chrome as malicious.
True Positive
False Negative
True Negative
False Positive
5
An attacker launches a mail spoofing attack. Which of the following commands will probably be used in the attack?
HELO server, MAIL FROM:[email protected], RCPTTO:[email protected],data
EHLO server, MAIL FROM:[email protected], RCPTTO:[email protected],run
EHLO server, FROM:[email protected], TO:[email protected], data
HELLO server, MAIL FROM:[email protected], RCPTTO:[email protected], run
6
What is the main purpose of pfSense?
DHCP
Firewall
IDS / IPS
Anti-virus
7
A security company wants to learn new attack methods. Which of the following would be a good way to do that?
NIDS
Pen Testing
Honeypots
HIDS
8
What is the definition of an alert?
The notification of a major crisis in the organization
Query that checks rules for each log. Match results in alerts
A type of bypass technique whereby an attacker may pop up an alert
None of these
9
What is DomainKeys Identified Mail (DKIM)?
Mail sending technique
Mail security server
Email validation
MX DNS service
10
Why should alerts be generated?
To configure EDR systems in the OS
To monitor what employees do
To monitor and handle suspicious events
To monitor user activity regarding malicious phishing attempts
11
A NOC manager wants to collect logs from the Windows OS in Splunk. What needs to be installed and configured?
RSYSLOG
Subscription for each computer
Universal Forwarder
None of these
12
Which of the following artifacts does an AV search for?
Only viruses
Strings manipulations and user clicks
Phishing sites
Strings, hashes, heuristics
13
If the following query was sent to a SIEM: 'source="/var/log/auth.log"', what would the output be?
UNIX authentication logs
UNIX authentication of SIEM access
Windows authentication logs
Windows event logs
14
What is the definition of log aggregation?
Logs with alert combinations
Collecting logs with similar structures
A type of brute-force attack
Logs that disappear
15
Which of the following is not information that requires DLP protection?
Customer data
Public web pages
IP
PII
16
Why is defense in layers important?
Defense in layers is a military strategy not applicable to cybersecurity.
Defense in layers provides a first layer designed to be unpassable
It is not important, but merely a suggestion.
Multiple layers of defense have a better chance of thwarting intruders
17
Why are IoT devices known to be vulnerable to many attacks?
Few developers know how to protect against IoT attacks
Companies do not have information security managers.
Because of a lack of security awareness among developers.
IoT devices are not known to be more vulnerable than other components.
18
May 21 07:41:22 pcx02 sshd[703]: Accepted password for root from 10.10.1.1 port 55811 ssh2.
A pcx02 connection was established on 05/21 with an admin username.
An SSH connection was established on 05/21 with an admin username.
A pcx02 connection was established at 07:42 with a root username.
An SSH connection was established on 05/21 with a root username.
19
What is a honeypot?
Phishing decoy
Decoy device to lure attackers
Table containing passwords and equivalent hashes
DDoS
20
What is the purpose of a log query?
To retrieve information from a service manager
To retrieve information from the SIEM /var/log only
To retrieve information from SIEM
To retrieve information from a SIEM script installer

CIT Exam Flashcards | StudBud