Quiz 10: Auditing, Monitoring, and Logging

The basic operation of a system logging facility is to collects events from log files, processes the data, stores the results, and performs notification or alerting, as required.

Logs provide dynamic records of running processes.

What is logged in the system log is predetermined by Windows.

Most system logs are very difficult to collect, store, read, and understand.

COBIT provides a framework to support information security requirements and assessment needs.

A(n) ____ is a task being performed by a computing system. A) handle C) action B) activity D) process

To investigate running processes, we would turn to the ____ in Linux. A) Task Manager C) PsLoggedOn tool B) ps command D) Wevtutil utility

____ are processes that are designed to operate without user interaction. A) States C) Activities B) Services D) Handles

In the Windows OS, services are usually initiated (loaded or started) at boot-up as ____, which consist of software code, data and/or other resources necessary to provide the service. A) firmware C) dynamic-link libraries (DLLs) B) daemons D) cache

You can view Ubuntu Linux distribution daemons using the ____. A) service DLL C) service management console B) service utility D) service command

Tracking events in which group membership has changed or rights have been elevated gives security professionals a warning that ____ is occurring. A) privilege escalation C) auditing B) directory traversal D) data leakage

On most current versions of Microsoft Windows-based systems, logging is managed by the ____, which is accessible from the system control panel. A) view daemon C) service command B) Event Viewer D) DLL

In Microsoft Windows-based systems, you can use the ____ to manage event logs from the command line. A) ps command C) service command B) PsLoggedOn tool D) Wevtutil utility

A spreadsheet program might record an error for access to a file in the ____ log. A) system C) application B) setup D) operation

From a network security perspective, the ____ logs are the most valuable to a systems and network administrator in identifying and resolving issues. A) admin and operational C) analytic and debug B) applications and services D) admin and analytic

Which Linux file records all logins and logouts that occur on the system? A) utmp C) cron B) btmp D) wtmp

Which Linux file shows a listing of failed login attempts? A) utmp C) cron B) btmp D) wtmp

The purpose of ____ is to manage the effects of changes or differences in configurations on an information system or network. A) security information and event management (SIEM) B) security operations center management(SOCM) C) configuration and change management (CCM) D) program monitoring

Within the change management process, after the need for a change has been identified, a(n) ____ is submitted to the appropriate decision-making body. A) contingency plan C) engagement letter B) incident report D) change request

As part of the initiation and planning audit phase, it is customary for a(n) ____ to be developed, which serves as a service agreement between the auditing team and the requesting entity. A) contingency plan C) engagement letter B) incident report D) change request

The primary focus of ____ is to determine if the standards and/or regulations the organization claims to comply with are, in fact, complied with. A) accreditation C) continuous monitoring B) configuration management D) an audit

____ demonstrates that management has identified an acceptable risk level and provided resources to control unacceptable risk levels. A) Certification C) Integrity B) Accreditation D) Authorization

The primary purpose of ____ is to enable organizations to obtain certification; thus, it serves more as an assessment tool than an implementation framework. A) ISO/IEC 27001 C) COBIT B) ISO/IEC 27002 D) ISACA

____ is an IT governance framework and supporting toolset that allows managers to bridge the gap between control requirements, technical issues, and business risks. A) ISO/IEC 27001 C) COBIT B) ISO/IEC 27002 D) ISACA

Which COBIT domain focuses on ongoing maintenance and change requirements to extend the usability of the system? A) Plan and Organize C) Delivery and Support B) Acquire and Implement D) Monitor and Evaluate

Which COBIT domain focuses on the functionality of the system for the end user? A) Plan and Organize C) Delivery and Support B) Acquire and Implement D) Monitor and Evaluate

A(n) ____________________ is any action that may be of interest to you on a device.

The exfiltration or unauthorized release of data, known as ____________________, is a top concern for most security professionals.

____________________ is the period of time that log files or log file data should be maintained.

A(n) ____________________ is a measurement of activity that represents the normal state or routine condition.

In security management, ____________________ is what authorizes an IT system to process, store, or transmit information.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -The date associated with a particular version or build.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A hardware or software item that is to be modified and revised throughout its life cycle.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A significant revision of the version from its previous state.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A collection of components that make up a configuration item.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A minor revision of the version from its previous state.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A collection of configuration items that is usually controlled and that developers use to construct revisions and to issue new configuration items.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A list of the versions of components that make up a build.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -The recorded state of a particular revision of a software or hardware configuration item.

Match each item with a statement below. a.Configuration item f.Build list b.Version g.Configuration c.Major release h.Revision date d.Minor release i.Software library e.Build -A snapshot of a particular version of software assembled (or linked) from its various component modules.

List the three actions that usually cause an audit system to log an event.

Describe two places where network connection events may be tracked and explain what events can be tracked.

Why is it important to keep track of system restart and shutdown events?

Explain the idea behind syslog and how it is used.

What are six things that log management technologies are designed to do?

Describe a security operation center (SOC).

Describe the purpose of change management.

After a change has been reviewed and evaluated, what three actions might be taken?

Explain the three categorical groupings for information processed by the federal government.

What is the purpose of ISO/IEC 27002?