CIT - Final Review
SIEM includes the following log May 21 741pm pcx02 ssh 703 accepted password for root from IP address port number 5581 to ssh?
SSH connection was established on May 21st with a root user.
Which of the following is a security mechanism that is configured to detect the seim and counterattack attempts to unauthorized access?
Honeypot
Security company wants to learn a new attack method, which of the following would be a good way to do that
Honeypots
NOC manager wants to collect logs from windows OS and Splunk?
Install universal forwarder service
Which of the following should be used secure a website against abnormal traffic dump?
DMZ
Which of the following is true about how an organization should protect itself from malicious emails?
All the above. (Use spam filters and malicious scanners, use strong passwords, use email encryption, don't open suspicious emails)
Which of the following query was sent to a Siem source=var log off log off.log what would be the output?
Unix authentication logs
Microsoft security essentials has tagged 2011 Google Chrome as malicious. What is the professional term related to this case?
False Positive
What is the main purpose of a SIEM solution?
Helps detect security incidents
Which of the following security measures is related to end point security?
Antivirus
Which of the following does not require DLP protection?
Public facing webpages
What is considered the weakest link in Security?
Untrained and Unaware people
Leakage of employee related information was discovered at a large company. The company learned that the leak took place after a phishing email. What should the company use or do to prevent this from happening again?
All of these (encrypt all sensitive data, analyze and categorize date, antivirus and email security).
Why are IoT devices known to be vulnerable to many attacks?
Because of lack of security awareness among developers
What is a honey pot?
Decoy device that lures attackers
What is DKIM (domainKeys identified mail)?
Email validation technique
What is more dangerous False Positive or Negative?
False Negative
What is the difference between fault tolerance and fail-safe implementation?
Fault tolerance ensures that the remaining components can maintain a system when one or more components fail, fail-safe implementation means that all components work together to prevent or minimize damage in case of disaster (LAST ONE)
What are examples of deterrent access controls? .
Fences, cameras, and motion detectors
What is the difference between firmware and software?
Firmware is fixed date that the user interacts with and the software what the user interacts with.
An attacker launches a mail spoofing attack which of the following commands will probably be used in the attack?
Hello server mail from admin@domain then rcpt to IP domain data.
What is domain key identified mail DKIM?
Mail Security Validation Technique
Why is fenced in layers important to security?
Multiple layers of security have a better chance of thwarting potential intruders
What is the main purpose of a pfsense firewall?
Open-source firewall
2 methods of getting data into Splunk?
Push and Pull (Apache kafka is another tool you can use)
A new company stores sensitive information and wants to secure information, using a system that reports and forensically analyze a security instant. What system should they use?
SEIM
Which of the follow artifacts does an AV search?
Strings, hashes, and heuristics
Why should alerts be generated?
To monitor and handle suspicious events in an organization
What is the purpose of a log query?
To retrieve information from the Siem
If the following query was sent to a Siem source var log off what would the output, look like?
Unix authentication log
What is the definition of an alert?
An automated script will be executed
What system scans for strings, hashes, and heuristics?
Antivirus
What is the name of the method that exposes data leakage by giving different versions of a sensitive document to each of several suspects and seeing which version gets leaked?
Canary Trap
What would it mean if I said how could you define log aggregation?
Collection of logs with a similar structure.
John downloaded a file a co-worker sent him. His antivirus alerted him about the file. What should John do?
White list the file.