Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does FIM typically notify administrators of file changes?

   • ABy physically locking the file system
   • BBy sending alerts via email or SIEM integration
   • CBy sending a text message to all employees
   • DBy printing a report to the system console
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst needs to monitor network traffic to understand the behavior of applications and users, including file transfers, DNS queries, and HTTP requests. The analyst wants a tool that generates detailed logs of network activity for later analysis. Which tool should the analyst use?

   • AZeek
   • BSuricata
   • CNmap
   • DSnort
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team is evaluating network monitoring tools and needs one that can perform deep packet inspection, handle high-throughput traffic, and support multi-threading for performance. Which tool is best suited for this requirement?

   • AZeek
   • BSnort
   • Ctcpdump
   • DSuricata
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is investigating a suspected ARP spoofing attack on the corporate network. The analyst wants to confirm the attack and identify the source. Which approach would be most effective?

   • AReview the firewall logs for blocked inbound connections from unknown IP addresses.
   • BInspect the server's application logs for unusual login activity.
   • CCapture network traffic and compare the MAC-to-IP mappings in ARP packets against the known MAC addresses of legitimate devices.
   • DUse a vulnerability scanner to check for the ARP spoofing vulnerability on all hosts.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator notices that a server is sending small, periodic outbound connections to an IP address in a foreign country every 10 minutes, regardless of user activity. The administrator suspects the server may be compromised and communicating with a command-and-control (C2) server. Which detection method would best confirm this suspicion?

   • ACheck the server's file integrity monitoring (FIM) reports for unauthorized file changes.
   • BReview the server's local authentication logs for failed login attempts.
   • CAnalyze network flow logs to identify the regular interval and consistent destination of the connections.
   • DRun a vulnerability scanner against the server to find known exploits.
   Reveal Solution Discussion Select an answer first