Host OS Monitoring GCTD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security analyst notices that /var/log/auth.log on a Linux VM has been cleared. The FIM tool did not alert because the file was truncated, not modified. The analyst needs to detect this type of event in the future. Which configuration change would be most effective?

   • AUse a log forwarding agent that sends logs to a central server in real time
   • BConfigure the FIM tool to monitor file size and inode changes, not just content hashes
   • CSet the log file to be immutable using chattr +i
   • DIncrease the frequency of FIM scans to every minute
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's security policy requires that any change to the /etc/passwd file on Linux VMs triggers an alert within 5 minutes. The current file integrity monitoring (FIM) tool runs a full scan every 24 hours. Which configuration change best meets the requirement?

   • AConfigure a cron job to run a hash check on /etc/passwd every hour
   • BEnable real-time monitoring for /etc/passwd using the FIM tool's inotify or auditd integration
   • CIncrease the FIM scan frequency to every 5 minutes
   • DMove /etc/passwd to a read-only filesystem
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is investigating a potential brute-force attack on a Linux server. The auth.log shows thousands of failed SSH attempts from different IP addresses, but no successful login. The analyst needs to determine if any of the attempts succeeded. Which log or data source would provide the most definitive answer?

   • AThe 'last' command output showing successful logins
   • BThe system's CPU usage during the attack
   • CThe firewall logs showing allowed connections
   • DThe process list at the time of the attack
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Why is host OS monitoring important in a cloud environment, even though the cloud provider manages the underlying infrastructure?

   • AIt replaces the need for network-level monitoring and logging.
   • BIt is required by all cloud providers to maintain service-level agreements.
   • CIt ensures the cloud provider's hypervisor is patched and up to date.
   • DIt provides visibility into the security and performance of the guest OS and applications that run on the customer's virtual machines.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's file integrity monitoring (FIM) solution alerts on a change to /etc/ssh/sshd_config. The change was made by a system administrator during a scheduled maintenance window. What should the analyst do to prevent this from generating a false positive in the future?

   • AUpdate the FIM baseline to include the new hash after verifying the change is legitimate
   • BIgnore the alert and do nothing
   • CDisable the FIM alert for 24 hours
   • DRemove the file from the FIM monitoring list
   Reveal Solution Discussion Select an answer first