Reference no: EM133337540

QUESTION 1

For effective log management, an organization should establish logging as a standard business practice.

True

False

QUESTION 2

Which of these examples is a PowerShell tool that is used to detect suspicious Windows event log entries?

a. Skadi

b. DeepBlueCLI

c. Event Log Explorer

d. wevtutil

QUESTION 3

Log roll over is defined as ________.

a. Rolling logs over from an endpoint to a SIEM.

b. An event log analysis technique used by incident responders.

c. When an attacker purposely deletes logs to hide their tracks.

d. The fact that endpoints have limited space and new log files overwrite old log files.

QUESTION 4

Which is not one of the functions of a SIEM?

a. Log retention

b. Automated response

c. Alerting

d. Log aggregation

QUESTION 5

Which of these is a portable system that allows for quick log collection using CyLR.exe and storage and indexing using the Elastic Stack?

a. Skadi

b. DeepBlueCLI

c. Event Log Explorer

d. wevtuil

QUESTION 6

Which of these is not part of the Elastic Stack?

a. Kibana

b. Elasticsearch

c. Log Response

d. Logstash

QUESTION 7

Locard's exchange principle states that when two objects encounter each other, they leave traces.

True

False

QUESTION 8

Which of the following is NOT an issue that the CSIRT should address before incident response?

a. Comprehensive logging

b. Knowledgeable personnel

c. Log acquisition

d. Document failures

QUESTION 9

What do you call the process of collecting logs in a central location?

a. Log acquisition

b. Log management

c. Log analysis

d. Log aggregation

QUESTION 10

Which of the following is a pattern-matching language is used by SIEMs, programming language, and other tools to search for text?

a. Pattern expressions (PatEx)

b. Regular Expressions (RegEx)

c. Text Expressions (TextEx)

d. Lattice Expressions (LaTex)