4.9

Question 1

Packet Captures

Answer 1

used to capture and analzye network traffic

Question 2

What types of logs are there?

Answer 2

firewall, app, endpoint, os specific, ips and ids, networ

Question 3

SIEM

Answer 3

security info and event monitoring system
Real-time analysis of security alerts from applications and network hardware
■ Combination of different data sources into one tool
■ Provides a consolidated view of network activity
■ Allows for trend analysis, alert creation, and correlation of data

Question 4

Log files

Answer 4

Records events and messages in operating systems, software, and network
devices
■ Includes network, system, application, security, web, DNS, authentication, dump
files, VoIP, and call managers

Question 5

Syslog, Rsyslog, Syslog-ng

Answer 5

■ Tools for centralizing log data from different systems into a repository
■ Commonly used to feed data into SIEM

Question 6

Journalctl

Answer 6

Linux command-line utility for querying and displaying logs from the Journal
Daemon (SystemD’s logging service)

Question 7

nxlog

Answer 7

Multi-platform, open-source log management tool
■ Identifies security risks and analyzes logs from server, OS, and applications

Question 8

netflow

Answer 8

Network protocol for collecting active IP network traffic data
■ Provides information on source, destination, volume, and path

Question 9

sFlow

Answer 9

sampled flow
Open-source alternative to NetFlow
■ Exports truncated packets and interface counter for network monitoring

Question 10

IPFix

Answer 10

(Internet Protocol Flow Information Export)
■ Universal standard for exporting IP flow information
■ Used for mediation, accounting, and billing by defining data format for exporters
and collectors

Question 11

MD5/SHA256 Checksum

Answer 11

Serves as unique digital fingerprint for file identification, including potential
malware