Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SOC is monitoring syslog messages from a web server. They notice a high volume of '404 Not Found' messages for URLs containing 'wp-admin', 'phpmyadmin', and '.env'. What is the most likely interpretation?

   • AAn attacker is scanning the web server for vulnerable applications or sensitive files.
   • BA legitimate user is trying to access old content that has been moved.
   • CThe web server is misconfigured and returning 404 errors for legitimate pages.
   • DThe web server is under a denial-of-service attack.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a syslog entry, what does the severity level '5' (Notice) typically indicate?

   • AA debugging message that is only useful for troubleshooting
   • BA critical failure that requires immediate action
   • CA normal but significant condition that may require attention
   • DAn informational message that requires no action
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a SIEM that receives syslog from multiple sources. The SIEM is configured to accept messages on TCP port 514. A new firewall is being added, and the administrator configures it to send syslog to the SIEM. The messages are not appearing in the SIEM. The firewall logs show that messages are being sent. What is the most likely cause?

   • AThe SIEM is not parsing the firewall's syslog format.
   • BThe firewall is sending messages with a severity level that the SIEM filters out.
   • CThe SIEM is listening on TCP port 514, but the firewall is sending via UDP by default.
   • DThe firewall is sending messages to the wrong IP address.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of the syslog protocol in a networked environment?

   • ATo manage and distribute configuration files to network devices
   • BTo provide a standardized way for devices and applications to send event messages to a central logging server
   • CTo encrypt all network traffic between clients and servers to ensure confidentiality
   • DTo authenticate users attempting to access network resources
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do audit logs differ from syslog messages in terms of their primary focus?

   • AAudit logs are generated only by firewalls, while syslog is generated by all devices
   • BAudit logs focus on security-relevant user and system actions, while syslog messages cover a broader range of operational events
   • CAudit logs are always encrypted, while syslog messages are always sent in clear text
   • DAudit logs are stored locally, while syslog messages are always sent to a remote server
   Reveal Solution Discussion Select an answer first