Understanding Monitoring and Auditing Flashcards
Which of the following can stop in-progress attacks on your network?
Network IDS
Network IPS
Proxy server
Network IPS
A network-based intrusion prevention system (NIPS) analyzes network traffic patterns, generates event logs and alerts system administrators to events, and sometimes stops potential intrusions. Some implementations have a database of known attack patterns, while others can take notice of abnormal traffic for a specific network. The administrator can then take measures to stop the attack, such as dropping offending packets. IPS and other device logs and alerts can be centrally collected, aggregated, correlated, and reported on by a SIEM system
Which of the following would an administrator most likely use to determine whether there has been unauthorized use of a wireless LAN?
Protocol analyzer
Performance Monitor
Wireless access point logs
Wireless access point logs
Wireless access points as well as wireless router logs can reveal all wireless LAN activity. Some access points may require you to enable logging. In an enterprise, log events should be forwarded to a central logging host to facilitate the detection of suspicious activity
You are responsible for managing an internal FTP server. A user reports that files available on the server yesterday are no longer available. Where can you look to determine what happened to the missing files?
Firewall log
FTP access log
FTP download log
FTP access log
File Transfer Protocol (FTP) access logs list file activity on FTP servers, including file deletions or renames
As a Windows server administrator for server ALPHA, you configure auditing so that you can track who deletes files on the file share SALES. Where will you view the audit results?
Security log
Audit log
Application log
Security log
Windows machines write audit data to the Event Viewer security log. A centralized SIEM system can store audit log data from many devices in a single repository where the data is written once but can be read many times—write once read many (WORM). WORM functionality is sometimes required for regulatory compliance. An additional benefit is deduplication of similar events, which results in less storage space consumed and quicker searching
Your manager asks you to configure a honeypot to track malicious user activity. You install the host in the screened subnet without any patches and configure a web site and an SMTP server on it. You have configured nothing else on the host. Identify a problem with this configuration.
The honeypot needs to be patched.
Honeypots should not run a web site.
Honeypot logs are not being forwarded to another secured host.
Honeypot logs are not being forwarded to another secured host.
The honeypot host is unpatched and is therefore vulnerable, so storing the only copy of log files (a default setting) on a honeypot means attackers could delete the contents of logs to remove all traces of their malicious activity
Which of the following are true regarding behavior-based network monitoring? (Choose two.)
A baseline of normal behavior must be established.
Deviations from acceptable activity cannot be monitored.
New threats can be blocked.
A database of known attack patterns is consulted.
A baseline of normal behavior must be established.
New threats can be blocked.
Behavior-based monitoring detects activity that deviates from the norm. A baseline is required to establish what normal is. Because of this, new attacks could potentially be stopped if they do not conform to normal network usage patterns
You have configured a network-based IPS appliance to prevent web server directory traversal attacks. What type of configuration is this?
Behavior-based
Signature-based
Anomaly-based
Signature-based
Comparing known attacks against current activity is called signature-based detection
An administrator reports that a Windows file server is performing much slower than it normally does. The server is fully patched and has an up-to-date virus scanner. You open an RDP connection to the server to investigate the problem. Which of the following should you first use?
Port scanner
System restore point
Performance Monitor
Performance Monitor
Windows machines include Performance Monitor to measure which aspect of the software or hardware is not performing as well as it should
You have inherited the responsibility of managing an office network for which there is no documentation. As you perform desktop support duties over time, by viewing network and host configuration reports you notice many users seem to have more privileges on the network than they need. What should you do?
Delete and re-create all user accounts.
Conduct a user access and rights review.
Check server audit logs.
Conduct a user access and rights review.
A user access and rights review identifies the rights and permissions users must have compared to what they have been given. In this case, the review would reveal what needs to be changed so users have only the rights needed to do their jobs
To adhere to new corporate security guidelines, your branch offices must track details regarding web sites visited by employees. What should you install to track this activity?
VPN
Proxy server
Packet-filtering firewall
Proxy server
Proxy servers can track detailed web-surfing activity including site visited, time of day, user account name, and so on. The reliability of this data relies heavily upon time synchronization of all network devices
Which of the following are true regarding a network-based IDS? (Choose two.)
Network traffic is analyzed for malicious packets.
Alerts and notifications can be configured.
Malicious packets are dropped.
Laptops are protected when disconnected from the LAN.
Network traffic is analyzed for malicious packets.
Alerts and notifications can be configured.
A NIDS monitors and analyzes network traffic for malicious packets; if it finds any, it then triggers an alert or notification
Which of the following is true regarding a HIDS?
Suspicious traffic entering the network can be blocked.
Encrypted transmissions cannot be monitored.
It must be installed on each system where needed.
It must be installed on each system where needed.
A HIDS is a host-based solution and thus must be installed on individual hosts. A HIDS has the benefits of being very application specific and being able to monitor each host at all times
You are asked to analyze events in a firewall log that occurred six months ago. When you analyze the log file, you notice events go back only two months. What is most likely the problem?
You must have administrative access to the logs.
The log file size is too small.
Firewalls cannot keep logs for more than two months.
The log file size is too small.
The firewall is probably configured to overwrite the oldest log entries after the maximum log file size has been reached. Even in this case, however, there are normally log archival options available for configuration
A Windows administrator must track key performance metrics for a group of seven Windows servers. What should she do?
Run Performance Monitor on each host.
Use RDP to log into each host and check Event Viewer logs.
Run Performance Monitor on her machine and add counters from the other seven servers.
Run Performance Monitor on her machine and add counters from the other seven servers.
Like many Microsoft administrative tools, Performance Monitor can run locally but can display data (performance counters) added from remote hosts
You are a firewall appliance administrator for your company. Previously restricted outbound RDP packets are now successfully reaching external hosts, and you did not configure this firewall rule. Where should you look to see who made the firewall change and when?
Security log
Firewall log
Audit log
Audit log
Audit logs differ from regular activity logs because they record administrative configuration activities, such as modifying firewall rules
