Host OS Monitoring GCTD Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's security policy requires detection of unauthorized changes to critical system binaries on Linux hosts. The current monitoring solution only collects CPU and memory metrics. Which additional configuration is most effective for meeting this requirement?

   • AConfigure a cron job to run 'ls -la' on critical directories.
   • BIncrease the frequency of log collection for system logs.
   • CDeploy a file integrity monitoring tool like OSSEC or Wazuh to monitor critical files.
   • DEnable auditd to log all file access events.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst notices a cloud VM's CPU usage has been pegged at 100% for 20 minutes. The process list shows a binary named 'worker' running from /tmp. The analyst needs to determine if this is malicious and, if so, contain it. Which action should the analyst take first?

   • AKill the 'worker' process and delete /tmp/worker
   • BReboot the VM to clear the high CPU usage
   • CSnapshot the process memory and capture its command-line arguments, parent process, and network connections
   • DImmediately block all outbound traffic from the VM in the cloud security group
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst is reviewing host logs and notices multiple failed SSH login attempts from a single IP address, followed by a successful login at 3:00 AM. The analyst needs to determine if this is a security incident. Which additional data source would provide the most useful context?

   • AThe VM's CPU and memory usage at the time of login
   • BThe VM's disk space usage
   • CThe VM's network security group rules
   • DThe command history of the user who logged in
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which type of host OS log is most likely to contain records of successful and failed user login attempts?

   • ASystem log
   • BAuthentication log
   • CKernel log
   • DApplication log
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A cloud operations team is experiencing performance degradation on a VM. They have been collecting CPU and memory metrics, but the issue persists. They suspect disk I/O contention. Which additional metric should they collect to confirm this?

   • ADisk queue length and disk latency
   • BNumber of running processes
   • CNetwork packet loss
   • DSystem uptime
   Reveal Solution Discussion Select an answer first