Interpret System Logs 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of the syslog protocol?

   • ATo provide secure remote access to network devices
   • BTo synchronize time across network devices
   • CTo transfer files between systems
   • DTo collect and forward log messages from network devices and servers to a central location
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A Windows administrator needs to review the event logs to troubleshoot a recent application crash. Which built-in Windows tool should they use?

   • AEvent Viewer
   • BTask Manager
   • CPerformance Monitor
   • DDevice Manager
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An administrator notices that a user account that normally logs in only during business hours has a successful logon at 3:00 AM. What type of anomaly does this represent?

   • AUnusual time of activity
   • BUnexpected privilege change
   • CMalware infection
   • DRepeated failure pattern
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is investigating a potential data breach. The analyst needs to determine which files were accessed by a specific user account. Which audit policy and log should the analyst use?

   • AEnable Directory Service Access auditing and review the Security log
   • BEnable Account Logon auditing and review the System log
   • CEnable Process Creation auditing and review the Application log
   • DEnable Object Access auditing and review the Security log
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security analyst is reviewing syslog messages from multiple devices and notices that a user account has been successfully logging into a Linux server via SSH at 2:00 AM every day for the past week. The account is a standard user account. The analyst also sees that the same account has been failing to log into a Windows server at 2:05 AM. Which conclusion is most justified?

   • AThe account may be compromised, but the analyst should first verify if the user has a legitimate reason to access both systems at that time
   • BThe account is definitely compromised because the logins are successful on Linux but failing on Windows
   • CThe account is definitely not compromised because the user is a standard user
   • DThe account is definitely compromised because the logins occur at an unusual time
   Reveal Solution Discussion Select an answer first