Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations center (SOC) wants to detect when a user account is created or modified on a critical server. The SOC has a SIEM that ingests both syslog and audit logs. Which monitoring rule should the SOC implement?

   • ACreate a SIEM rule that triggers on any audit log event with the event type 'EXECVE'.
   • BCreate a SIEM rule that triggers on any syslog message containing the word 'user'.
   • CCreate a SIEM rule that triggers on syslog messages from the authpriv facility with priority 'notice'.
   • DCreate a SIEM correlation rule that triggers on audit log events with the event type 'USER_ACCOUNT' or 'ROLE_ASSIGNMENT'.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which protocol is commonly used to securely forward syslog messages to a central collector?

   • ASyslog over TLS (often using TCP port 6514)
   • BFTP over port 21
   • CHTTP over port 80
   • DICMP echo requests
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team must collect audit logs from 500 Windows servers and 100 Linux servers into a SIEM. The team has limited budget and cannot deploy agents on every server. The SIEM supports both Windows Event Forwarding (WEF) and syslog. Which approach minimizes agent deployment while ensuring comprehensive audit log collection?

   • AUse WEF on both Windows and Linux servers by installing a WEF client on Linux.
   • BConfigure syslog on the Windows servers using a built-in Windows syslog service.
   • CDeploy a third-party agent on all Windows and Linux servers to forward logs to the SIEM.
   • DConfigure WEF on the Windows servers to forward to a central Windows collector, and configure rsyslog on the Linux servers to forward to the SIEM directly.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a potential privilege escalation on a Linux server. The analyst needs to determine which user executed a specific sudo command and when. Which log source should the analyst consult first?

   • AThe bash history file for the root user, searching for the command.
   • BThe syslog messages from the kernel facility, looking for authentication failure entries.
   • CThe audit log from the Linux audit daemon (auditd), filtering for the relevant execve or USER_CMD records.
   • DThe syslog messages from the authpriv facility, looking for the sudo command line.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When interpreting an audit log entry, which field is most important for identifying the user responsible for a security-relevant action?

   • AThe system's hostname
   • BThe user ID or account name associated with the event
   • CThe message ID or event type
   • DThe severity level of the event
   Reveal Solution Discussion Select an answer first