Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a standard component of a syslog message?

   • ATimestamp, hostname, facility, and severity level
   • BEncryption algorithm, key length, and certificate serial number
   • CUsername, password hash, and session token
   • DSource IP address, destination port, and protocol type
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC is monitoring syslog messages from a firewall. They notice a sudden increase in 'connection refused' messages from a single internal IP to many external IPs on port 25. What is the most likely interpretation?

   • AThe firewall is misconfigured and blocking legitimate email traffic.
   • BAn external attacker is scanning the internal network for open mail ports.
   • CA compromised internal host is attempting to send spam or perform a port scan for mail servers.
   • DA legitimate email server is experiencing a high volume of inbound mail.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which monitoring practice is most effective for detecting unauthorized access attempts from syslog and audit logs?

   • ADeleting old logs to free up storage space
   • BSetting up alerts for repeated failed login attempts from the same source
   • CDisabling audit logging on non-critical systems
   • DReviewing logs only after a security incident is reported
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is reviewing audit logs and sees a series of events where a user's account is locked out, then unlocked, then locked out again, repeating every few minutes. The user is a high-privilege administrator. What is the most likely explanation?

   • AThe account is configured to lock and unlock automatically as part of a maintenance script.
   • BThe user has a weak password and is accidentally triggering lockouts.
   • CThe audit log is malfunctioning and generating false events.
   • DAn attacker is attempting to brute-force the account, and a separate process is automatically unlocking it after each lockout.
   Reveal Solution Discussion Select an answer first
6. 15application · medium · select all that apply

   A security analyst is reviewing audit logs and notices a series of events where a service account (svc_backup) is enabling and disabling itself repeatedly. Select all the security-relevant conclusions that are appropriate.

   • AThis could be a misconfigured automation script that is accidentally toggling the account.
   • BThis could be an attempt to evade audit logging by disabling the account during malicious activity.
   • CThis is a clear sign of a data breach and the account should be immediately disabled permanently.
   • DThis is normal behavior for a backup service account and requires no investigation.
   • EThis could indicate an attacker is using the service account to maintain persistence by toggling the account.
   Check answers Discussion Select an answer first