DCOM 258 Final Exam Review Questions and Answers
100% Correct;(Latest solutions)
Which of the following techniques enables an already secure organization to
assess security vulnerabilities in real time?
Continuous monitoring
Which of the following can determine which flags are set in a TCP/IP handshake?
Protocol analyzer
Which of following is the most basic form of IDS?
Signature-based
You suspect a broadcast storm on the LAN. Which tool is required to diagnose
which network adapter is causing the storm?
Protocol analyzer
Which of the following log files should show attempts at unauthorized access?
Security
Jason is a security administrator for a company of 4000 users. He wants to store
6 months of security logs to a logging server for analysis. The reports are
required by upper management due to legal obligations but are not time-critical.
When planning for the requirements of the logging server, which of the following
should not be implemented?
Performance baseline and audit trails
What kind of security control do computer security audits fall under?
Detective
Which tool can be instrumental in capturing FTP GET requests?
Protocol analyzer
Michael has just completed monitoring and analyzing a web server. Which of the
following indicates that the server might have been compromised?
The web server is showing a drop in CPU speed and hard disk speed.
Which of the following protocols are you observing in the packet capture below?
16:42:01 - SRC 192.168.1.5:3389 - DST 10.254.254.57:8080 - SYN/ACK
RDP
Which of the following requires a baseline? (Select the two best answers.)
Behavior-based monitoring
Anomaly-based monitoring
What tool can alert you if a server's processor trips a certain threshold?
Performance Monitor
You have established a baseline for your server. Which of the following is the
best tool to use to monitor any changes to that baseline?
Performance Monitor
Your boss wants you to properly log what happens on a database server. What
are the most important concepts to think about while you do so? (Select the two
best answers.)
The amount of disk space you will require
The information that will be needed to reconstruct events later
, One of the developers in your organization installs a new application in a test
system to test its functionality before implementing into production. Which of the
following is most likely affected?
Initial baseline configuration
Which of the following is a record of the tracked actions of users?
Audit trails
Of the following, which two security measures should be implemented when
logging a server? (Select the two best answers.)
The application of retention policies on log files
Hashing of log files
You have been alerted to suspicious traffic without a specific signature. Under
further investigation, you determine that the alert was a false indicator.
Furthermore, the same alert has arrived at your workstation several times. Which
security device needs to be configured to disable false alarms in the future?
(Select the best answer.)
Anomaly-based IDS
To find out when a computer was shut down, which log file would an
administrator use?
System
One of your co-workers complains to you that he cannot see any security events
in the Event Viewer. What are three possible reasons for this? (Select the three
best answers.)
Auditing has not been turned on.
The co-worker is not an administrator.
Auditing for an individual object has not been turned on.
You have been tasked with providing daily network usage reports of layer 3
devices without compromising any data during the information gathering
process. Which of the following protocols should you select to provide for secure
reporting in this scenario?
SNMPv3
Your manager wants you to implement a type of intrusion detection system (IDS)
that can be matched to certain types of traffic patterns. What kind of IDS is this?
Signature-based IDS
Which of the following is the best practice to implement when securing logs
files?
Copy the logs to a remote log server.
Which of the following should be done if an audit recording fails?
Send an alert to the administrator.
In what way can you gather information from a remote printer?
SNMP
What is the main reason to frequently view the logs of a DNS server?
To watch for unauthorized zone transfers
As you review your firewall log, you see the following information. What type of
attack is this?
S=207.50.135.54:53 - D=10.1.1.80:0
100% Correct;(Latest solutions)
Which of the following techniques enables an already secure organization to
assess security vulnerabilities in real time?
Continuous monitoring
Which of the following can determine which flags are set in a TCP/IP handshake?
Protocol analyzer
Which of following is the most basic form of IDS?
Signature-based
You suspect a broadcast storm on the LAN. Which tool is required to diagnose
which network adapter is causing the storm?
Protocol analyzer
Which of the following log files should show attempts at unauthorized access?
Security
Jason is a security administrator for a company of 4000 users. He wants to store
6 months of security logs to a logging server for analysis. The reports are
required by upper management due to legal obligations but are not time-critical.
When planning for the requirements of the logging server, which of the following
should not be implemented?
Performance baseline and audit trails
What kind of security control do computer security audits fall under?
Detective
Which tool can be instrumental in capturing FTP GET requests?
Protocol analyzer
Michael has just completed monitoring and analyzing a web server. Which of the
following indicates that the server might have been compromised?
The web server is showing a drop in CPU speed and hard disk speed.
Which of the following protocols are you observing in the packet capture below?
16:42:01 - SRC 192.168.1.5:3389 - DST 10.254.254.57:8080 - SYN/ACK
RDP
Which of the following requires a baseline? (Select the two best answers.)
Behavior-based monitoring
Anomaly-based monitoring
What tool can alert you if a server's processor trips a certain threshold?
Performance Monitor
You have established a baseline for your server. Which of the following is the
best tool to use to monitor any changes to that baseline?
Performance Monitor
Your boss wants you to properly log what happens on a database server. What
are the most important concepts to think about while you do so? (Select the two
best answers.)
The amount of disk space you will require
The information that will be needed to reconstruct events later
, One of the developers in your organization installs a new application in a test
system to test its functionality before implementing into production. Which of the
following is most likely affected?
Initial baseline configuration
Which of the following is a record of the tracked actions of users?
Audit trails
Of the following, which two security measures should be implemented when
logging a server? (Select the two best answers.)
The application of retention policies on log files
Hashing of log files
You have been alerted to suspicious traffic without a specific signature. Under
further investigation, you determine that the alert was a false indicator.
Furthermore, the same alert has arrived at your workstation several times. Which
security device needs to be configured to disable false alarms in the future?
(Select the best answer.)
Anomaly-based IDS
To find out when a computer was shut down, which log file would an
administrator use?
System
One of your co-workers complains to you that he cannot see any security events
in the Event Viewer. What are three possible reasons for this? (Select the three
best answers.)
Auditing has not been turned on.
The co-worker is not an administrator.
Auditing for an individual object has not been turned on.
You have been tasked with providing daily network usage reports of layer 3
devices without compromising any data during the information gathering
process. Which of the following protocols should you select to provide for secure
reporting in this scenario?
SNMPv3
Your manager wants you to implement a type of intrusion detection system (IDS)
that can be matched to certain types of traffic patterns. What kind of IDS is this?
Signature-based IDS
Which of the following is the best practice to implement when securing logs
files?
Copy the logs to a remote log server.
Which of the following should be done if an audit recording fails?
Send an alert to the administrator.
In what way can you gather information from a remote printer?
SNMP
What is the main reason to frequently view the logs of a DNS server?
To watch for unauthorized zone transfers
As you review your firewall log, you see the following information. What type of
attack is this?
S=207.50.135.54:53 - D=10.1.1.80:0
