Determine How to Monitor Syslog and Audit Log CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key benefit of correlating syslog and audit log data from multiple sources?

   • AIt eliminates the need for real-time monitoring
   • BIt automatically patches security vulnerabilities
   • CIt reduces the total volume of logs that need to be stored
   • DIt helps identify attack patterns that span multiple systems
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the first step in configuring audit log collection for comprehensive security monitoring?

   • AInstall a SIEM platform before any other configuration
   • BEnable audit policies to capture the relevant security events on the source systems
   • CConfigure the firewall to block all inbound traffic to the log collector
   • DSet up a VPN tunnel between the source systems and the log collector
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A network appliance only supports sending syslog over UDP. The security team needs to ensure these messages are not lost when the central collector is briefly unavailable. What should the team do?

   • AConfigure a second syslog destination on the appliance and run a local syslog daemon that buffers messages and forwards them to the central collector over TCP.
   • BIncrease the UDP socket buffer size on the central collector to prevent any message loss.
   • CChange the appliance's syslog protocol to TCP, even though it is not supported.
   • DAccept the loss because UDP is inherently unreliable and no mitigation is possible.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team needs to collect audit logs from a fleet of IoT devices that only support syslog over UDP. The team must ensure that logs are not lost and are available for forensic analysis. Which approach is most appropriate?

   • AConfigure the IoT devices to send logs directly to the SIEM over UDP, accepting potential loss.
   • BIncrease the UDP buffer size on the IoT devices to prevent loss.
   • CUse a packet capture tool on the network to capture all UDP traffic to the SIEM.
   • DSet up a local syslog relay on the same network segment as the IoT devices, which receives UDP messages and writes them to a persistent disk buffer before forwarding to the central SIEM over TCP.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A database server runs on Linux and the security team needs to capture all SQL queries executed by administrators. Which configuration should the team implement?

   • AConfigure syslog to capture all messages from the database's daemon and forward them to the SIEM.
   • BEnable Linux auditd to monitor the database process's system calls, including read and write operations.
   • CEnable the database's native audit logging feature and configure it to write to a dedicated audit log file, then forward that file to the SIEM.
   • DEnable tcpdump on the database server's network interface to capture all traffic to port 3306.
   Reveal Solution Discussion Select an answer first