Network Logs Monitoring and Analysis CND Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst needs to identify all login failures across multiple servers in the last 24 hours and see if any user account has failed more than 10 times. Which SIEM feature is most appropriate?

   • AUse a dashboard that shows all login events.
   • BCreate a real-time alert for every failed login.
   • CExport all logs to a spreadsheet and manually count.
   • DRun a query that aggregates failed logins by user account and filters for counts greater than 10.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An analyst is reviewing a Linux server's auth log and sees multiple entries like 'Failed password for root from 203.0.113.5 port 22 ssh2'. The entries occur every 10 seconds for 30 minutes. The analyst also sees a successful login for user 'admin' from the same IP. Which conclusion is most appropriate?

   • AThe server is under a brute-force attack, and the successful login indicates the attacker gained access.
   • BThe server is experiencing a denial-of-service attack because of the high volume of failed logins.
   • CThe failed logins are likely due to a misconfigured application using the wrong credentials.
   • DThe successful login is unrelated to the failed attempts because it used a different username.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   While reviewing firewall logs, a defender notices repeated failed SSH login attempts from a single external IP to multiple internal servers, followed by a successful login to one server at 3:00 AM. Which log analysis technique would most directly confirm whether the successful login was part of a brute-force attack?

   • ACheck the firewall logs for outbound connections from the internal server to the external IP.
   • BCorrelate the successful login timestamp with the failed attempts and check the server's authentication logs for the source IP.
   • CCount the total number of failed attempts across all servers to determine the attack's intensity.
   • DReview the server's system event logs for any service crashes around the time of the successful login.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A SIEM generates an alert for a possible brute-force attack based on multiple failed logins from one IP. However, the defender notices that the failed logins are spread across different user accounts and occur at regular intervals. What does this pattern suggest, and what should the defender do?

   • AIt is a password spraying attack; reset all user passwords immediately.
   • BIt is definitely an attack; immediately block the IP at the firewall.
   • CIt is likely a misconfigured application; ignore the alert.
   • DIt may be a distributed brute-force attack; correlate with other sources to confirm before blocking the IP.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's SIEM receives logs from a firewall, an Active Directory domain controller, and an email gateway. An analyst sees a firewall log entry showing an outbound connection from a workstation to an external IP on port 443. The email gateway log shows a user received a phishing email with a link to that same IP. The domain controller log shows a successful authentication for that user from the workstation at the same time. Which conclusion is best supported by correlating these logs?

   • AThe user likely clicked the link, but additional logs (e.g., proxy, DNS) are needed to determine if the connection was malicious.
   • BThe workstation is compromised because the user authenticated and then made an outbound connection.
   • CThe user clicked the phishing link and the workstation established a command-and-control channel.
   • DThe email gateway should have blocked the link, so the firewall log is the only reliable indicator.
   Reveal Solution Discussion Select an answer first