CIT - Final Review

SIEM includes the following log May 21 741pm pcx02 ssh 703 accepted password for root from IP address port number 5581 to ssh?

SSH connection was established on May 21st with a root user.

Which of the following is a security mechanism that is configured to detect the seim and counterattack attempts to unauthorized access?

Honeypot

Security company wants to learn a new attack method, which of the following would be a good way to do that

Honeypots

NOC manager wants to collect logs from windows OS and Splunk?

Install universal forwarder service

Which of the following should be used secure a website against abnormal traffic dump?

DMZ

Which of the following is true about how an organization should protect itself from malicious emails?

All the above. (Use spam filters and malicious scanners, use strong passwords, use email encryption, don't open suspicious emails)

Which of the following query was sent to a Siem source=var log off log off.log what would be the output?

Unix authentication logs

Microsoft security essentials has tagged 2011 Google Chrome as malicious. What is the professional term related to this case?

False Positive

What is the main purpose of a SIEM solution?

Helps detect security incidents

Which of the following security measures is related to end point security?

Antivirus

Which of the following does not require DLP protection?

Public facing webpages

What is considered the weakest link in Security?

Untrained and Unaware people

Leakage of employee related information was discovered at a large company. The company learned that the leak took place after a phishing email. What should the company use or do to prevent this from happening again?

All of these (encrypt all sensitive data, analyze and categorize date, antivirus and email security).

Why are IoT devices known to be vulnerable to many attacks?

Because of lack of security awareness among developers

What is a honey pot?

Decoy device that lures attackers

What is DKIM (domainKeys identified mail)?

Email validation technique

What is more dangerous False Positive or Negative?

False Negative

What is the difference between fault tolerance and fail-safe implementation?

Fault tolerance ensures that the remaining components can maintain a system when one or more components fail, fail-safe implementation means that all components work together to prevent or minimize damage in case of disaster (LAST ONE)

What are examples of deterrent access controls? .

Fences, cameras, and motion detectors

What is the difference between firmware and software?

Firmware is fixed date that the user interacts with and the software what the user interacts with.

An attacker launches a mail spoofing attack which of the following commands will probably be used in the attack?

Hello server mail from admin@domain then rcpt to IP domain data.

What is domain key identified mail DKIM?

Mail Security Validation Technique

Why is fenced in layers important to security?

Multiple layers of security have a better chance of thwarting potential intruders

What is the main purpose of a pfsense firewall?

Open-source firewall

2 methods of getting data into Splunk?

Push and Pull (Apache kafka is another tool you can use)

A new company stores sensitive information and wants to secure information, using a system that reports and forensically analyze a security instant. What system should they use?

SEIM

Which of the follow artifacts does an AV search?

Strings, hashes, and heuristics

Why should alerts be generated?

To monitor and handle suspicious events in an organization

What is the purpose of a log query?

To retrieve information from the Siem

If the following query was sent to a Siem source var log off what would the output, look like?

Unix authentication log

What is the definition of an alert?

An automated script will be executed

What system scans for strings, hashes, and heuristics?

Antivirus

What is the name of the method that exposes data leakage by giving different versions of a sensitive document to each of several suspects and seeing which version gets leaked?

Canary Trap

What would it mean if I said how could you define log aggregation?

Collection of logs with a similar structure.

John downloaded a file a co-worker sent him. His antivirus alerted him about the file. What should John do?

White list the file.