Interpreting Events GSOC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which category of security event is typically generated by a firewall?

   • AMalware signature updates
   • BUser authentication logs
   • CApplication error logs
   • DNetwork traffic logs
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An IDS generates an alert for a known exploit against a web server. The web server logs show the exploit payload was sent, but the server returned a 200 OK response. The web server is running a patched version of the software. What is the best interpretation?

   • AThe server is definitely compromised because the exploit was sent.
   • BThe exploit attempt may have failed due to the patch, but the alert should be documented and monitored for follow-up activity.
   • CIgnore the alert because the server is patched.
   • DThe alert is a false positive because the server responded with 200 OK.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   After an incident, an analyst must write a report. Which approach best supports future investigations and compliance?

   • AInclude only the final conclusion and the remediation steps.
   • BSummarize the incident in a few paragraphs without technical details to keep the report short.
   • CStore the report in a personal folder to avoid cluttering the ticketing system.
   • DRecord the timeline of events, the evidence collected, and the actions taken in a structured format.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An IDS generates an alert for a known exploit attempt against a web server. The analyst checks the web server logs and finds no corresponding request that matches the exploit signature. What is the most appropriate conclusion?

   • AThe alert is definitely a true positive because the IDS is always accurate.
   • BEscalate the alert to incident response because the IDS alert is more reliable than web server logs.
   • CThe alert may be a false positive, but the analyst should verify the IDS signature and ensure the web server logs are complete.
   • DThe alert is definitely a false positive because the web server logs do not show the request.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which statement best defines a security event?

   • AA log entry that is always malicious
   • BA configuration change made by an administrator
   • CA confirmed intrusion that has caused data loss
   • DAny observable occurrence in a system or network that may indicate a security-relevant activity
   Reveal Solution Discussion Select an answer first