SecurityX_Objective_1.1_Flashcards
(8 cards)
1
Q
What does a SIEM do?
A
Collects, correlates, and analyzes logs from multiple sources to detect and investigate threats.
2
Q
What command filters SSH login failures in Linux?
A
grep “Failed password” /var/log/auth.log
3
Q
What is tcpdump used for?
A
Capturing and analyzing network packets.
4
Q
What command starts a SYN scan with Nmap?
A
nmap -sS -T4 -Pn <IP></IP>
5
Q
Which Event ID corresponds to a failed login on Windows?
A
4625
6
Q
What tool detects ARP spoofing?
A
arpwatch or tcpdump (monitor for suspicious ARP replies)
7
Q
What’s the difference between IDS and EDR?
A
IDS detects network intrusions; EDR monitors and responds to endpoint threats.
8
Q
What does tail -f do?
A
Continuously displays new lines from a log file.
