Security Monitoring Flashcards
Which Linux command can be used to monitor Linux host performance?
- chmod
- top
- grep
- lsblk
top
You need to determine which process in Windows is causing excessive disk activity. What should you use?
- IIS
- Performance Monitor
- Resource Monitor
- Group Policy
Resource Monitor
In which Windows log will user smartcard logon auditing appear?
- Application
- Security
- System
- Hardware
Security
Which benefits does Microsoft Defender for Cloud provide?
- Cloud resource inventory
- Cloud resource security recommendations
- Conditional Azure AD access
- SOAR automation
Cloud resource inventory
Cloud resource security recommendations
What is the purpose of a SIEM solution?
- Update management
- Device inventory
- Workstation imaging
- Threat hunting
Threat hunting
Which Microsoft Sentinel component can be used to automate responses to detected security incidents?
- Action group
- Workspace
- Data connector
- Playbook
Playbook
You are reviewing web server logs and notice many entries for clients attempting to connect with “../../../../” as the request. Which type of attack was most likely occurring?
- SQL injection
- Password spraying
- Directory traversal
- User account brute-force
Directory traversal
You would like email notifications sent to admins when a cloud storage account’s egress traffic exceeds a specified amount. What should you create?
- Key vault
- Action Group
- Resource Group
- Alert
Action Group
Where are most Linux logs located in the file system?
- /etc/logs
- /bin/logs
- /var/logs
- /usr/logs
/var/logs
Which definition accurately describes a true negative?
- Benign activity is incorrectly reported as malicious
- No alerts because problematic conditions are not present
- Current configuring does not detect malicious activity
- Correctly identified malicious activity actually exists
No alerts because problematic conditions are not present
What is the default port number used for Linux syslog forwarding?
- 80
- 514
- 389
- 443
514
You are configuring Windows Event Viewer log forwarding for Windows clients joined to an Active Directory domain. The logging server will reach out to clients to pull log data to itself. What must be done on each client machine?
- The logging server must be added to the EventLogReaders group
- Run Winrm qc
- Run gpudate /force
- An Event Viewer subscription must be configured on each client
The logging server must be added to the EventLogReaders group
Run Winrm qc
You need to automate the response to brute-force attacks against a number of critical servers. Which type of solution should you use?
- WAF
- SOAR
- SLA
- IDS
SOAR
