Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the purpose of analyzing detection logs?

   • ATo configure new firewall rules
   • BTo delete unnecessary files from the system
   • CTo optimize network performance
   • DTo review and understand security events detected by monitoring systems
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security administrator is configuring file integrity monitoring (FIM) on a critical database server. The administrator wants to detect unauthorized changes to configuration files while minimizing the performance impact on the server. Which configuration should the administrator implement?

   • AEnable FIM on the configuration files and schedule scans to run every hour during business hours and every four hours after hours.
   • BEnable FIM only on the database data files and schedule scans to run once a week.
   • CDisable FIM and rely on the database's native audit logs.
   • DEnable FIM on all files on the server and set scans to run every 15 minutes.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common method used to monitor network traffic?

   • AScanning files for malware
   • BUsing a packet capture tool to inspect packets
   • CReading system event logs only
   • DReviewing user access permissions
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst suspects that sensitive data is being sent out of the network in HTTP requests. Which monitoring technique would be most effective in confirming this?

   • AMonitor the volume of outbound traffic to identify large transfers.
   • BReview firewall logs for allowed outbound connections.
   • CCheck the DNS logs for queries to suspicious domains.
   • DInspect the content of outbound HTTP packets for sensitive data patterns.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a feature of Suricata?

   • AIt is a commercial product only
   • BSupport for both IDS and IPS modes
   • CIt cannot inspect encrypted traffic
   • DIt is a cloud-only solution
   Reveal Solution Discussion Select an answer first