Quiz
Network Security Monitoring basics and investigations
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (112)
1 It is important for an investigator to have a pre-conceived idea of the incident to guide them
down the path of what to investigate.- Atrue
- Bfalse
2 The role of a network security investigator is to:
- AFine-tune an IDS to minimize false negatives
- BFine-tune an IDS to minimize false positives
- Cinvestigate alerts generated by an IDS
3What is the difference between an alert and a warning?
- AA warning is an indicator generated by an IDS and an alert is the fornicator's
interpretation of that warning - BAn alert is an indicator generated by an IDS and a warning is the fornicator's
interpretation of that alert
- AA warning is an indicator generated by an IDS and an alert is the fornicator's
4The goal of a forensic investigator is to
- Aprevent intrusions from taking place
- Bdetermine what an intruder has done so that the incident can be quickly contained and
cleaned up - Cfigure out who to blame for the intrusion
5What are the four questions that a forensic investigator needs to ask at the start of an
investigation?- AWho is the intruder, where are they from, and what are they after, and what did they get?
- BWhat did the intruder do, when did they do it, do they still have access, and how bad was
the compromise? - CWhat vulnerability did the intruder leverage, how did they leverage it, what data did they
they take, and is the data sensitive?
6Intrusion detection systems all often fail for all of the following reasons EXCEPT for what?
- ADeployment was a "set and forget" mentality
- BHumans aren't interpreting the warnings
- CHumans aren't reviewing the IDS logs
- DA host based IDS was used instead of a network based IDS
7If your system generates thousands of transactions per second, how should you be monitoring it?
Optional Answers:- AYou should capture and analyze all of it
- BYou should apply sampling
- CYou should figure out how to reduce the number of transactions so that it can me
reasonably monitored - DYou should look at a different system that does not generate as much traffic
81. In the context of NSM, what is the correct definition of alerts, warnings, and escalations?
Optional Answers:- AAlerts- indicators generated by IDSs, warnings- the result of an analyst's interpretation of
indicators, escalations-sent to decision-makers - Bwarnings- indicators generated by IDSs, alerts- the result of an analyst's interpretation of
indicators, escalations-sent to decision-makers - Cescalations- indicators generated by IDSs, alerts- the result of an analyst's interpretation
of indicators, warnings-sent to decision-makers - Descalations- indicators generated by IDSs, warnings- the result of an analyst's
interpretation of indicators, alerts-sent to decision-makers
- AAlerts- indicators generated by IDSs, warnings- the result of an analyst's interpretation of
9 It has been claimed that encryption has rendered intrusion detection obsolete, is this true?
Optional Answers:- AYes, encryption conceals the entire packet, so you can't get any useful information when
it is encrypted - BNo, most of the time weak encryption is used, so it is possible to crack it
- CNo, you can still see who's talking, for how long, and when
- DNo, you can capture network traffic before it is encrypted, so you see it in plain text
- AYes, encryption conceals the entire packet, so you can't get any useful information when
10Calculate estimated minimum storage required for 72 hours of full packet capture on a 1 Gbps
link with an average 25% SX and 75% RX utilization.
Optional Answers:
SX + RX * GPS -> convert to MBPS -> * time- A1. ~42 TB
- B2. ~32 TB
- C3. ~48 TB
- D4. ~24 TB
11 All of the following except one may limit what network data you can capture.
Optional Answers:- Alocal policies, laws, and regulations
- Bif it is encrypted
- Cdisk storage
- Dbandwidth
12A VPN makes it so that an ISP can not see the contents of our traffic.
Optional Answers:- Atrue
- Bfalse
13NSM involves interpreting live traffic as it traverses the network.
Optional Answers:- Atrue
- Bfalse
14NSM relies on all of the following for investigations, except for what?
- Afull content
- Bvulnerabilities
- Cstatistical data to detect and validate events
- Dalerts
15 When a user clicks on a link in a malicious email, all of the following systems are involved EXCEPT:
Optional Answers:- AAttacker's C2 server
- BWeb Proxy server
- CISP's DNS Server
- DDNS Server
162. What is the de facto file format standard of network traffic captures?
Optional Answers:- Acap
- Bdump
- Cpcap
- Dlibpcap
17A flow is:
Optional Answers:- Acommunication between one host and all of its destinations
- Ball communication involving the same source and destination ports and the same
protocol - Ccommunication between the same hosts using the same source and destination ports
and the same protocol - Dcommunication between all hosts on a network during a point in time
18Which of the following can provide NetFlow data?
Optional Answers:- ACloud services
- Brouters
- Cfirewalls
- Dall of the above
19Which phase has the highest probability of detection?
Optional Answers:- APillage
- BExploitation
- CReinforcement
- DReconnaissance
20In 2019, what percentage of the known attacks involved ransomware?
Optional Answers:- A15%
- B96%
- C43%
- D75%
21Which section of an enterprise network should be setup to allow network traffic originating from
the Internet?
Optional Answers:- AInternal Network
- BDMZ
- Call section of the enterprise network
- DWireless zone
22Since all network traffic coming from the wireless network, DMZ, and internal network flows
through the router adjacent to the Internet this is the best place to capture traffic
Optional Answers:- ATrue, all traffic will flows through this router
- BFalse, you would miss internal traffic (e.g. traffic from a wireless device to a server on the
internal network)
23The Internet facing IP address is a private IP address (e.g. 192.168.x.x)
Optional Answers:- Atrue
- Bfalse
24With address translation, Internet sites are able to see private IP addresses.
Optional Answers:- ATrue, when an internal device with a private IP address is allowed to contact an Internet
device (such as devices in the DMZ) - BFalse, devices with private IP addresses are prevented from contacting external public IP
addresses - CFalse, a firewall or gateway allows translation of a private IP address to a public-facing IP
address - DTrue, a firewall or gateway allows the publication of a private IP address
- ATrue, when an internal device with a private IP address is allowed to contact an Internet
25Given a web server with an IP address of 192.168.2.100, and an external gateway on the subnet
198.51.100/24, the external address of the web server could be:
Optional Answers:- A198.51.100.100
- B192.168.1.100
- C192.168.2.1
- D192.168.2.100
26The difference between NAT and NPAT is:
Optional Answers:- ANPAT uses a one-to matching of IP addresses while NAT uses a single IP and changes the
source port to differentiate among computers - BNAT uses a one-to matching of IP addresses while NPAT uses a single IP and changes the
source port to differentiate among computers - CNAT uses a one-to matching of IP addresses while NPAT uses a single IP and changes the
protocol to differentiate among computers
- ANPAT uses a one-to matching of IP addresses while NAT uses a single IP and changes the
27When using NPAT, two laptops on the wireless network could appear on the Internet with the
same IP address.
Optional Answers:- Atrue
- Bfalse
28What is the difference between Wireshark and tshark?
Optional Answers:- AThey are the exact same tool
- BWireshark is GUI based and tshark is console based
- CWireshark is console based and tshark is GUI based
- DThey are completely different tools
29Time stamps in PCAP files is in which format?
Optional Answers:- AUNIX epoch
- BYMD-HMS
- CUTC
- DGreenwich Mean Time
30pcapng is new file format replacing pcap and is fully supported by critical pcap-aware tools
Optional Answers:- Atrue
- Bfalse
31When you add "-n" to a tcpdump statement, what happens?
Optional Answers:- Ait will only capture traffic for specific IP address and/or port number
- Bit won't perform a DNS lookup for each IP
- Cit allows to you specify which network interface to capture on
32What is the tool capinfos used for?
Optional Answers:- AIt is a console tool that allows you to parse through a pcap file.
- BIt returns the number of packets, file size and data size of a file.
- CIt is used to convert a pcapng file to a pcap file.
- DIt reduces the size of a pcap file by filtering out specific traffic.
33Which tcpdump option will capture just the first 1,000 packets?
Optional Answers:- A-c 1000
- B-a 1000
- C-s 1000
34The -G option is tcpdump specifies
Optional Answers:- Ahow many hours to write to one file before rotating to the next
- Bhow many days to write to one file before rotating to the next
- Chow many minutes to write to one file before rotating to the next
- Dhow many seconds to write to one file before rotating to the next
35How do you filter through DNS records for responses that do not contain a specific address?
- Adns.a && dns.a != 192.168.8.248
- Bdns.a != 192.168.8.248
- Cdns.a && !(dns.a==192.168.8.248)
- Ddns.a != (192.168.8.248)
Thank You
36NPAT is a subset of NAT
Optional Answers:- Atrue
- Bfalse
37In a NATed environment, a computer sends a packet with its source computer port, the router
then:
Optional Answers:- Auses the computer's source port to uniquely identify the packet
- Breplaces the computer's source port with the port related to the service that the
computer is connecting to - Cgenerate a new port number to replace the sending computer's source port number
- Dcombines the sending computer's IP address and port number to create a unique ID
38To identify unique connections routers use the combination of
Optional Answers:- A. source MAC address and destination MAC address
- Bsource IP address, source port, destination IP address, destination port
- Csource IP address, source port, destination IP address, destination port, IP protocol
- Dsource IP address, source port, destination IP address, destination port, MAC address
39Given a /24 network, how many devices can we match one-to-one when NATing?
Optional Answers:
IP address = 32 bits
2^32-x- A~24
- B~254
- C~508
- D~65,536
40As a packet traverses the internal network, the sending computer's IP address in the packet
Optional Answers:- Awill be replaced with the MAC address of the computer so that it will be uniquely
identified no matter what subnet it is on - Bwill change based upon the subnet that the router is forwarding the packet on
- Cwill have the IP address of each router appended to the end of the IP address
- Dill have a port number assigned by the router added to the original IP address
- Awill be replaced with the MAC address of the computer so that it will be uniquely
41What is the best location to monitor DMZ Network Traffic?
Optional Answers:- Aanywhere in the internal network that has a router with an open port
- Bon each device located in the DMZ
- Con the port facing the DMZ of the closet router to the DMZ
- Don the inter port of the internet-facing route
42If you needed to start collecting network traffic and were told that there couldn't be any
downtime what method would you do?
Optional Answers:- Ause port mirroring
- Badd a network tap
- Cstart capturing traffic with Wireshark on the device of interest
- Dperform a MITM attack to run all of the traffic through your computer
43How likely is it that an attacker would see a network tap on the network?
Optional Answers:- Avery unlikely since the tap is passive
- Bsomewhat likely since the traffic is redirected to a new location
44Would a hacker, if they got physical access to the device, be able to install a tap to monitor the
network?
Optional Answers:- Ayes, they could install one just as we could install one
- Bnot very likely, since they would need a password to access router
45Which version of HTTP is the most common today?
Optional Answers:- A.9
- B1.0
- C1.1
- D2.0
46Which HTTP request is the client’s request of a resource from the server?
Optional Answers:- APUT
- BCONNECT
- CGET
- DPOST
47When is the information sent in the User-Agent field in HTTP reliable?
Optional Answers:- Ait is never reliable
- Bit is always reliable
- Cwhen the computer sending it is in our locked-down environment
- Dwhen the data is encrypted
48The difference between a session cookie and a persistent cookie, is that the persistent cookie is
never removed from the client (as the name suggests).
Optional Answers:- Atrue
- Bfalse
49The authentication field in the HTTP header is used to:
Optional Answers:- Atell the web server which encrypted method to use (e.g. TLS 1.1)
- Btell the web server is authentication is necessary for this session
- Cencode a username and password in a pop-up dialog box
- Dsend the client's username and password to the server
506. The purpose of the HTTP header Forwarded For is:
Optional Answers:- Aused by a firewall to indicate the original source of the request
- Bused by a router to indicate the original source of the request
- Cused by a forwarding agent to indicate the original source of the request
- Dused by a proxy server to indicate the original source of the request
51It is extremely important that the HTTP response code and response phrase match up correctly.
Optional Answers:- Atrue
- Bfalse
52Which of the following could be a SQL Injection attempt and success?
Optional Answers:- AA series of 400-series codes against a search form followed by a 200 response and a lot
oof HTTP POST requests - BA series of 500-series codes against a search form followed by a 200 response and a lot of
HTTP GET requests - CA series of 500-series codes against a search form followed by a 200 response and a lot of
HTTP POST requests - DA series of 400-series codes against a search form followed by a 200 response and a lot of
HTTP GET requests
- AA series of 400-series codes against a search form followed by a 200 response and a lot
53The code "family" indicating redirection is
Optional Answers:- A200
- B300
- C400
- D500
54The value in the "content-length" field, located in a HTTP header sent from the server, represents
Optional Answers:- Athe number of bytes in the payload of the response
- Bthe number of bits in the body of the response
- Cthe number of bytes in the body of the response
- Dthe number of bits in the payload of the response
55f you suspect that an intruder extracted your data and sent it to a site like PasteBin, what filter
would you use in Wireshark on the captured network traffic?
Optional Answers:- Aftp
- Bsftp
- Chttp.request.method==GET
- Dhttp.request.method==POST
56How long does a utma cookie live for?
Optional Answers:- A2 years rolling retention
- B1 year rolling retention
- C6 months rolling retention
- D30 minute rolling retention
57Which of the following is NOT true about SOF ELK and Arkime?
Optional Answers:- A4. SOF ELK is used to process Netflow data while Arkime processes full packet capture (pcap
files) - BSOF ELK is scalable while Arkime is not
- CArkime and SOF ELK are both built on Elasticsearch
- DArkime and SOF ELK are both open source
- A4. SOF ELK is used to process Netflow data while Arkime processes full packet capture (pcap
58Which tool would you use to quickly find the geo location of the IP addresses in a pcap file
capture?
Optional Answers:- Atcpstat
- BScapy
- CLibnids
- DDshell
59All of the following is true about scapy except:
Optional Answers:- ACan be used toBuild your own sniffer and/or pcap reader
- BLow-level Python framework to parse, decode and create (and forge) packets
- COpen-source project from U.S. Army Research Lab
- DIts intended purpose is to create and inject packets to a network segment
60What is tcpflow used for?
Optional Answers:- ALow-level Python framework to parse, decode and create (and forge) packets
- BHTTP web server provides detailed output, searching, and filtering
- CFacilitates basic object extraction
- DSearch traffic for strings or regular expressions
61All of the following are true about NetworkMiner except:
Optional Answers:- ADoes not scale well
- BFree version version can export in JSON format
- CDeveloped for Windows
- DExtracts credentials
62 Which statement about NetworkMiner is correct?
Optional Answers:- As an open source tool which parses pcap files into a format readable by SOF-ELK
- Bs a commercial tool, but has a free version which extracts objects (files, images, etc.) from
pcap files - CIs a commercial tool, but has a free version which parses pcap files into a format readable
by SOF-ELK - DIs an open source tool which extracts objects (files, images, etc.) from pcap files
63Wireshark provides inline TLS decryption functionality if you have:
Optional Answers:- Athe initial and re-key negotiations and the public key
- Bjust the private key
- Cthe initial and re-key negotiations and the private key
- Dthe public and private keys
64Using Netflow we saw 15.5M MB transferred in one connection. With this information we can
determine that:- Aa 15.5 MB file was transferred
- Bthere were 100 web page loads of 155 KB each
- Cten 1.55 MB files were transferred
- Deach of the above is possible, but we aren't able to know for sure
655. What is ja3 and what is it used for?
Optional Answers:- A. is used to capture per-encrypted TLS traffic by running as an extension in a client's
browser - BIs used to identify client software by creating a unique fingerprint out of parameters
contained in the TLS hello message - CIs used to identify the version of TLS in use by reading through a pcap file and looking for
unique parameters - Dis used to identify the Requested SSL/TLS version, cipher suites, SSL/TLS extensions used
in a TLS hello message
- A. is used to capture per-encrypted TLS traffic by running as an extension in a client's
66What is HTTPS?
Optional Answers:- Aa TLS wrapper over HTTP
- Ban encrypted version of HTTP called TLS
3. secure HTML - Can encrypted version of HTTP called TLS
- DHTTP with embedded encryption
67The important property of a primitive root is
Optional Answers:- Ait only factors into large prime numbers
- Bwhen raised to different exponents the solution distributes uniformly between zero and
the modulus - Cwhen multiplied by different numbers the solution distributes uniformly between zero
and the modulus - Dthat it has no known prime factors
68How does the browser check to see if the certificate was issued by a trusted third party?
Optional Answers:- Athe browser has a list of trusted third-party certificate authorities
- Bthe browser uses the public key issued by the certificate authority and if it successfully
decrypts the communication then it is legitimate - Cthe browser checks the certificate via an online central repository of known good
certificates - Dthe browser has a list of known bad third-party certificate authorities
69Which of the following is not true about encryption and encoding?
Optional Answers:- Aencryption is a subset of encoding
- Bencoding is a subset of encryption
- C. it is possible to discern a properly encrypted message from random data
- Dthe strength of the encryption method is tied to minimal public knowledge of the
algorithm that was implemented
70What is MIME?
Optional Answers:- Ais used to encrypt email attachments that were previously relying on base64 encoding for
security - Ba weird guy with a painted white face
- Cis an authentication method for SMTP
- D. is used to extend the format of email messages to support attachments of audio, video,
and images
- Ais used to encrypt email attachments that were previously relying on base64 encoding for
71Which SMTP encryption protocol is the most common?
Optional Answers:- ANative TLS
- BSTARTTLS
- CSecure SMTP
- DSMTP TLS
72Which SMTP port(s) can be encrypted with STARTTLS?
Optional Answers:- Anone of the above
- Bboth
- C587
- D25
73what protocol is in use when sending from the user to the user's mail server?
Optional Answers:- AMail Transfer Agent (MTA)
- BMail Delivery Agent (MDA)
- CMail Submission Agent (MSA)
- DMail User-Agent (MUA)
74All of the following are suspicious SMB activity except for:
Optional Answers:- AEnumeration of file shares and large copy actions
- BClient-to-client file shares over SMB
- CFile share access by same account from different machines, LANs, and even countries
- DClient-to-server file shares over SMB
753. What version of SMB would be used if a Windows 10 client is talking to a Windows Server 2008 R2
server?
Optional Answers:- A3.0
- B2.1
- C2.0
- D1.0
762. Which Outlook to Exchange protocol encodes instead of encrypts its communication?
Optional Answers:- AIMAP/POP3
- BSMTP
- CRPC
77Where would you expect to see SMB file access traffic?
Optional Answers:- AExternal network traffic
- Binternal network traffic
- CBoth external and internal network traffic
78What Wireshark feature would you use to see all of the data related to one connection?
Optional Answers:- AApply the filter "ftp.data.stream"
- BApply "follow tcp stream"
- CApply "follow data stream"
- DApply the filter "tcp.stream"
79What is the difference between passive and active FTP?
Optional Answers:- AWith active FTP the server connects to the client to send the data and in passive the client
connects to the server to receive data - BWith passive FTP the server and the client connect and transfer over the same channel,
while in active the use different channels - CWith active FTP the server and the client connect and transfer over the same channel,
while in passive the use different channels - DWith passive FTP the server connects to the client to send the data and in active the client
connects to the server to receive data
- AWith active FTP the server connects to the client to send the data and in passive the client
80 What is the IP and port resulting in the FTP port command: 10,12,42,1,10,100
Optional Answers:
PORT a1,a2,a3,a4,p1,p2
a1,a2,a3,a4 are the four bytes of the IP
p1*256 + p2- A10.12.42.1.10 port 100
- B10.12.42.1 port 2660
- C. 10.12.42.1 port 10 and port 100
- D10.12.42.1 port 1350
81hat is sent over FTP's data channel?
Optional Answers:- Aall responses from the server
- Btransferred files
- Call FTP communication is sent over the data channel
- Dtransferred files and the results of terminal commands
82What is the difference between FTP and SFTP?
Optional Answers:- ASFTP is just the more secure version of FTP
- BFTP uses two channels to communicate while SFTP only uses one
- CTo improve the security of FTP, the communication channel has been encrypted and the
tool is now called SFTP
83Which tool turns pcap files into NetFlow?
Optional Answers:- Anfdump
- Bnfcapd
- Cnfpcapd
- DNetFlow Converter
84Which of the following is suspicious for DNS traffic?
Optional Answers:- Asmall client volume, large server volume, various connection connection duration
- Blarge client volume, large server volume, long connection connection duration
- Csmall client volume, small server volume, long connection connection duration
- Dlarge client volume, large server volume, various connection connection duration
85For an SCP download you would expect to see the following over SSH:
Optional Answers:- Alarge client volume, large server volume, long connection duration
- Bsmall client volume, small server volume, long connection duration
- Csmall client volume, large server volume, various connection duration
- Dsmall client volume, large server volume, long connection duration
86The NetFlow Exporter sends log data over:
Optional Answers:- Acarrier pigeons (birds aren't real)
- BUDP
- CTCP
87Which one of the following is true about NetFlow?
Optional Answers:- ACisco developed it 1996 originally as a route caching tool
- BIt is an open-source tool developed by the creators of Wireshark
- CCompanies such as Juniper, Citrix, IBM, and Netgear all use NetFlow
88All of the following are reasons to use NetFlow except:
Optional Answers:- AIdentify top-talking IP addresses
- BAnalyze Network-to-network statistics
- CUse new intel with previously collected evidence
- DIdentify a malicious payload
89NetFlow captures include all of the following except
Optional Answers:- AProtocol
- Bstart and stop times
- CSource/destination Ips
- DClient and server
90All of the following are problems associated with full-content pcap files, except:
Optional Answers:- AFor most organizations, full pcaps are not an option for privacy and data volume reason
- BFull-content capture is not possible since there is there isn't one point in an organization to capture all traffic
- CIncrease in encrypted traffic means less value for full pcap collection
- DFull-content pcap files don’t scale
917. What does SOF, of SOF-ELK stand for?
Optional Answers:- ASecure Operating Framework
- BSecurity Operations and Forensics
- CSystem Operations and Forensics
- DSplunk's Opensource Framework
92When you want to create the visualization showing "requests" per "user", what are those
attributes referred to as?
Optional Answers:- A"requests"- metric, "user"- bucket
- B"requests"- bucket, "user"- metric
- C"requests"- tuple, "user"- group
- D"requests"- column, "user"- row
93In Elasticstack, a URL should be stored in what format to make it as searchable as possible?
Optional Answers:- AKeyword
- BNode
- Cshard
- DText
94In what format does Elasticstack store logs?
Optional Answers:- ADatabase tables
- BJSON objects
- Cthe native format of the log files
- DDocuments
95Elasticsearch applies a schema
Optional Answers:- Aat search time
- Bat ingestion
- Cupon initial install
- Dwhen connected to a new dataset
96 Which part of the Elastic Stack is responsible for search and visualization?
Optional Answers:- ASplunk
- BVisualsearch
- CElasticsearch
- DKibana
97What is a SIEM?
Optional Answers:- ASoftware Innovation Elastic Model
- BSecurity Information and Event Management
- CSecret Intelligence Escape Module
- DSecurity Input Error Management
98What is punycode?
Optional Answers:
1. Punycode is embedded in DNS names allowing for malicious code to be inserted into DNS
names
2. A slur used by coders to describe unworthy code
3. Punycode encodes UNICODE in ASCII characters allowing for insertion of UNICODE
characters in a DNS name
4. Punycode encodes ASCII in UNICODE characters allowing for insertion of ASCII characters
in a DNS name- APunycode encodes ASCII in UNICODE characters allowing for insertion of ASCII characters
in a DNS name - BPunycode encodes UNICODE in ASCII characters allowing for insertion of UNICODE
characters in a DNS name - Cslur used by coders to describe unworthy code
- DPunycode is embedded in DNS names allowing for malicious code to be inserted into DNS
names
- APunycode encodes ASCII in UNICODE characters allowing for insertion of ASCII characters
99What has hindered forensicators' ability to analyze DNS traffic?
Optional Answers:- A. The encrypting of DNS using AES
- BThe encrypting of DNS over TLS
- CThe encrypting of DNS over TLS and HTTP
- DThe encrypting of DNS over SSH
100Historically botnet operators created domain names seeded with the current date followed by
random characters. These bogus domain names were easy to spot. Therefore, the botnet operators
switched to pairing up dictionary words to create their fake domain names.
Optional Answers:- Atrue
- Bfalse
101What is Fast-Flux DNS?
Optional Answers:- AA flux capacitor can be installed on a DNS server to improve search times
- BAllows for rapidly changing IP addresses to thwart the blocking of command and control
centers of botnets. - CAllows for rapidly changing IP addresses to hide malicious webservers
- DAllows for fast local searching of DNS records to speed up web browsing
102Which DNS record can store more data?
Optional Answers:- AAAAA records
- BTXT records
- CNULL records
- DA records
103Which type of DNS logging includes both the query and the response?
Optional Answers:- ATraditional DNS and Passive DNS
- BOnly Windows Analytical Event Logging
- CWindows Analytical Event Logging and Passive DNS
- D. Windows Analytical Event Logging and Traditional DNS
104Why should your clients use internal DNS resolvers?
Optional Answers:- A. So that their activity is captured in local DNS logs for forensic investigations and to block
them from going to known bad sites - B. Clients should use sites like Google's 8.8.8.8 site so that they receive the most up-to-date
information - CClients should use sites like CloudFlares's 1.1.1.1 site so that they receive the most
up-to-date information and so they aren't tracked - DTo block them from going to non-work-related sites
- A. So that their activity is captured in local DNS logs for forensic investigations and to block
105What is the order of operation when performing a DNS query?
Optional Answers:- AThe client system makes a query to the second level domain first
- BThe client system makes a query to the root level first
- CThe client system makes a query to the “local” DNS server first
- DThe client system makes a query to the Top Level Domain (TLD) first
106When would DNS use TCP instead of UDP?
Optional Answers:- Awhen the UDP port is busy it will rollover to TCP
- Bwhen the request is marked as "high importance" therefore using a stateful instead of a
stateless protocol - Cfor a “zone transfers” which is used for replicating large volumes of DNS data between DNS servers
- Dfor a “zone transfers” which is used to transfer the request to a different DNS server
107If you are performing a DNS lookup and the hostname does not exist, what response will you
receive?
Optional Answers:- AMX
- BNXDOMA
- CAAAA
- D404
108What HTTP log format can be used by both Apache and IIS?
Optional Answers:- A. Centralized Binary Logging, ODBC database
- BHTTP log
- CW3C Extended
- DNCSA Common+Vhost
109Which web server do you think was used to generate the NCSA Common Format log file?
Optional Answers:- ANCSA
- BIIS or Apache
- CIIS
- DApache
110The user-agent header string is supposed to store what?
Optional Answers:- Athe name of the web browser
- Bthe user's login info
- Cthe name of the user
- Dthe agent that sent the user to the page
111 In order to log TLS-wrapped Apache web traffic, you would need to
Optional Answers:- Aenable mod_forensic logging on the web server
- Bdecrypt the traffic with the web server's private key
- Cdecrypt the traffic using a brute force attack
- Ddecrypt the traffic with the web server's public key
112Which of the following commands will find all systems that requested a particular resource,
aggregate by frequency and sort?
Optional Answers:- Asudo grep “\GET /resource” access_log | awk ‘{print $1}’ | sort | uniq –c | sort –nr
- Bsudo cat access_log | awk ‘{print $9,$1,$7}’ | egrep “^5[0-9]{2}” | sort | uniq –c | sort -nr
- Csudo grep “^1.2.3.4” access_log | awk ‘{print $7}’ | sort | uniq –c | sort –nr
- D. sudo grep “\GET” access_log | awk ‘{print $7}’ | sort | uniq –c | sort –nr
Informações
- Descrição
- test networks final Quiz sobre Sem título, criado por Andre Shapiro em 16-05-2023.
- Autor
- Andre Shapiro
- Idioma
- English
- Visualizações
- 19
- Histórico
- Criado em 16 mai 2023 · atualizado em 16 mai 2023
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz