lab 26 Flashcards
How many security alerts for Rule ID 60112 are present for DC10?
13
17
23
42
17
What UserName is associated with the Rule ID 60112 security alerts on DC10?
administrator
structureality
jaime
DC10
jaime
What type of connection is indicated in the security alert for Rule ID 92653 related to jaime?
Local Workstation
Network Connection
Interactive
Remote Desktop Connection (RDP)
Remote Desktop Connection (RDP)
What is the status of the audit policies on DC10?
No Auditing
Success
Failure
Success and Failure
No Auditing
What is the Logon Type for this event record related to the jaime connection over RDP?
2
3
7
10
10
What is the logon type for the currently selected event record related to Dylan and MS10?
2
3
7
10
2
What is the setting selected in the Connection Settings area of Firefox?
No proxy
Auto-detect proxy settings for this network
Use system proxy settings
Manual proxy configuration
Automatic proxy configuration URL
Manual proxy configuration
The dstport value for one of the logged events between 10.1.16.2 and 203.0.113.228 indicates what about the transaction?
It was an encrypted session.
It was an FTP session.
It was an email transaction.
It was a plaintext communication.
It was a plaintext communication.
The .ps1 file extension on this script indicates what?
This is a PowerShell script.
This is a Bash shell script.
This is a batch script.
This is a python script.
This is a PowerShell script.
In the attack scenario of this lab, your investigation determined that which user account had the privileges to disable auditing on DC10?
dylan
jaime
MS10
root
jaime
Which event in the security violation took place first?
Jaime visiting the Juice Shop website
Dylan accessing DC10 over RDP
Changing the proxy settings of Firefox
Theft of Jaime’s credentials.
Changing the proxy settings of Firefox
What is a basic description of a logon of type 2?
Network
Unlock
RemoteInteractive
Interactive
Interactive
Which of the following security resolutions or mitigations would be sufficient to have prevented the audit policy changes on DC10?
Block the execution of unknown code
Disable RDP access to domain controllers
Enable additional logging on all systems
Use security cameras and personnel tracking technologies
Block the execution of unknown code
What is the goal of root cause analysis?
Identify the perpetrator.
Determine the initial parameters of a security violation.
Install patches to address vulnerabilities
Place blame on victims for falling for a social engineering attack
Determine the initial parameters of a security violation.
