Question 1

As part of the initiation and planning audit phase, it is customary for a(n) ____ to be developed, which serves as a service agreement between the auditing team and the requesting entity.

Accepted Answer

An engagement letter is developed as a formal agreement between the auditing team and the requesting entity, outlining the scope, objectives, and terms of the audit engagement.

Question 2

Logs provide dynamic records of running processes.

Accepted Answer

False

Question 3

In Microsoft Windows-based systems, you can use the ____ to manage event logs from the command line.

Accepted Answer

The Wevtutil utility is a command-line tool provided by Microsoft Windows to manage event logs, allowing users to query, view, and archive logs, among other functions.

Question 4

____ are processes that are designed to operate without user interaction.

Accepted Answer

Services are designed to run in the background and perform operations without direct user interaction, unlike activities which are designed for user interaction.

Question 5

COBIT provides a framework to support information security requirements and assessment needs.

Accepted Answer

COBIT (Control Objectives for Information and Related Technologies) is a framework designed to help organizations manage and govern their information and technology, supporting the establishment and maintenance of robust information security controls and assessments.

Question 6

The basic operation of a system logging facility is to collects events from log files, processes the data, stores the results, and performs notification or alerting, as required.

Accepted Answer

The answer of The basic operation of a system logging...

Question 7

The purpose of ____ is to manage the effects of changes or differences in configurations on an information system or network.

Accepted Answer

Configuration and Change Management (CCM) is specifically designed to manage the effects of changes or differences in configurations on an information system or network, ensuring that all changes are recorded, evaluated, authorized, prioritized, planned, tested, implemented, documented, and reviewed in a controlled manner.

Question 8

A(n) ____ is a task being performed by a computing system.

Accepted Answer

A process is the correct term for a task being performed by a computing system. It refers to an instance of a program that is being executed by one or many threads.

Question 9

On most current versions of Microsoft Windows-based systems, logging is managed by the ____, which is accessible from the system control panel.

Accepted Answer

Event Viewer is the tool in Windows-based systems used for accessing and managing system logs. It allows users to view and analyze event logs on a local or remote machine, making it a critical tool for troubleshooting and monitoring system health.

Question 10

Tracking events in which group membership has changed or rights have been elevated gives security professionals a warning that ____ is occurring.

Accepted Answer

Tracking events where group membership changes or rights are elevated is a key indicator of privilege escalation, as it involves increasing the permissions of a user account beyond what is normally allowed.

Question 11

In the Windows OS, services are usually initiated (loaded or started) at boot-up as ____, which consist of software code, data and/or other resources necessary to provide the service.

Accepted Answer

Dynamic-link libraries (DLLs) are used in Windows OS to provide services that are initiated at boot-up. These libraries contain code, data, and resources that various programs can use, allowing for shared functionality and more efficient memory usage.

Question 12

A spreadsheet program might record an error for access to a file in the ____ log.

Accepted Answer

A spreadsheet program, being an application, would record errors related to file access in the application log. This log is specifically designed to capture events and errors generated by software applications.

Question 13

Most system logs are very difficult to collect, store, read, and understand.

Accepted Answer

System logs can be complex due to their volume, variety, and the technical nature of the information they contain, making them challenging to manage and interpret without specialized tools and expertise.

Question 14

You can view Ubuntu Linux distribution daemons using the ____.

Accepted Answer

The correct way to view Ubuntu Linux distribution daemons is by using the "service" command. This command allows users to run System V init script actions such as start, stop, and status on services (daemons).

Question 15

What is logged in the system log is predetermined by Windows.

Accepted Answer

The types of events that are logged in the Windows system log are determined by the operating system's configuration and settings.

Question 16

From a network security perspective, the ____ logs are the most valuable to a systems and network administrator in identifying and resolving issues.

Accepted Answer

Admin and operational logs are the most valuable because they provide detailed information about system operations and administrative actions, which are crucial for identifying and resolving network security issues.

Question 17

Which Linux file records all logins and logouts that occur on the system?

Accepted Answer

The wtmp file in Linux systems records all logins and logouts. It is used for tracking user activity and system uptime.

Question 18

To investigate running processes, we would turn to the ____ in Linux.

Accepted Answer

The "ps" command in Linux is used to display information about the currently running processes, including their process IDs (PIDs). This makes it a fundamental tool for investigating running processes in a Linux environment.

Question 19

Within the change management process, after the need for a change has been identified, a(n) ____ is submitted to the appropriate decision-making body.

Accepted Answer

A change request is submitted to the appropriate decision-making body after the need for a change has been identified in the change management process.

Question 20

Which Linux file shows a listing of failed login attempts?

Accepted Answer

btmp records failed login attempts in Linux, allowing administrators to monitor unauthorized access attempts.

Quiz 10: Auditing, Monitoring, and Logging