Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A syslog message contains the following entry: 'Mar 10 14:22:31 webserver sshd[1234]: Failed password for invalid user admin from 192.0.2.10 port 54321 ssh2'. What does this entry indicate?

   • AA normal SSH authentication failure due to a user mistyping their password.
   • BAn SSH login attempt with a non-existent username, which could indicate a brute-force or reconnaissance attempt.
   • CA successful SSH login by user 'admin' after a password reset.
   • DA successful SSH login by user 'admin' from IP 192.0.2.10.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary role of audit logs in a security monitoring context?

   • ATo provide real-time performance metrics for system tuning
   • BTo transmit error messages to a central server for troubleshooting
   • CTo store backup copies of configuration files for disaster recovery
   • DTo record detailed records of security-relevant actions and events for accountability and forensic analysis
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the typical destination configuration when setting up syslog forwarding to a central log collector?

   • AThe hostname of the DNS server and the domain name of the network
   • BThe IP address or hostname of the central log collector and the UDP or TCP port it listens on
   • CThe email address of the security administrator and the SMTP server
   • DThe MAC address of the central log collector and the VLAN ID
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC analyst is reviewing audit logs and sees a single event where a user account was created, then immediately deleted, all within one minute. The account was named 'tempadmin'. The analyst must decide whether this is a security incident. What is the most appropriate next step?

   • AImmediately escalate to a full incident response and isolate the server.
   • BIgnore it because the account was deleted, so there is no ongoing risk.
   • CTreat it as a potential incident and investigate the source of the account creation, including the user and process that performed the action.
   • DAssume it was a legitimate IT process and close the ticket.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is it important to configure audit log collection to forward logs to a central location?

   • ATo increase the speed of the source system's applications
   • BTo comply with network bandwidth optimization requirements
   • CTo reduce the amount of storage space used on the source system
   • DTo ensure that logs are preserved even if the source system is compromised or fails
   Reveal Solution Discussion Select an answer first