Comptia Security+ Understanding Monitoring and Auditing

A security analyst is reviewing a log file that shows multiple failed login attempts to a server within a short period of time. Which monitoring technique would be most effective in identifying the source of these attempts?

• Intrusion Detection System (IDS)
• Intrusion Prevention System (IPS)
• Security Information and Event Management (SIEM)
• Network Traffic Analyzer
• Packet Capture and Analysis

Which of the following methods is commonly used to detect unauthorized changes to critical system files?

• Data loss prevention
• File integrity monitoring
• Port scanning
• Network intrusion detection
• Vulnerability scanning

Which of the following is a key characteristic of a continuous monitoring strategy?

• Periodic review of audit logs
• Retention of log files for 1 year
• Manual review of incidents
• Real-time monitoring
• Conducting periodic assessments

A security administrator is configuring a SIEM solution to monitor the network for possible security incidents. Which of the following should be the primary focus when defining correlation rules for the SIEM solution?

• Incident response procedures
• Network traffic analysis
• Network architecture diagrams
• Regulatory compliance requirements
• Security policies and procedures

Which of the following is an auditing technique that focuses on the identification of vulnerabilities in a system by simulating an attack?

• Vulnerability scanning
• Port scanning
• Penetration testing
• Log file analysis
• Security Information and Event Management (SIEM)

Which of the following is an example of an activity that can be monitored using a Network Intrusion Detection System (NIDS)?

• Application performance issues
• System downtime incidents
• Failed login attempts
• Unauthorized access attempts
• Firewall rule changes

A security administrator wants to monitor suspicious network traffic and detect any potentially malicious activities. Which of the following tools would be the most appropriate for this purpose?

• Security Information and Event Management (SIEM)
• Digital certificate authority
• Firewall logs analysis
• Intrusion Detection System (IDS)
• Penetration testing tool

A company is deploying a centralized logging solution to reduce the risk of data tampering. Which of the following is the best method to secure the logs and ensure their integrity?

• Implementing digital signatures on the logs
• Storing the logs on a removable media that is secured physically
• Using a secure logging service provided by a third-party vendor
• Encrypting the logs using strong encryption algorithms
• Regularly backing up the logs to an offsite location

Which of the following is commonly used to identify malicious activities on a network by comparing current network traffic against established patterns of normal behavior?

• Intrusion Prevention System (IPS)
• Web application firewall
• Anomaly detection
• Behavior-based analysis
• Intrusion Detection System (IDS)

Which of the following is an important aspect of audit trails in an auditing and monitoring environment?

• Retention of audit trails for 90 days
• Inclusion of detailed information about system events
• Real-time monitoring and reporting
• Clear identification of all system users
• Immediate notifications of security incidents