4.9 Log Data

Question 1

What type of information is commonly stored in log files?

Answer 1

Traffic flows, exploit attempts, blocked URLs, DNS sinkhole traffic

Log files contain vital information for analyzing network security.

Question 2

What can firewall logs provide information about?

Answer 2

Source and destination IP addresses, port numbers, traffic flow disposition

Firewalls monitor traffic both entering and leaving the network.

Question 3

What additional capabilities do Next Generation Firewalls (NGFW) offer?

Answer 3

Application information, feedback on URLs, detection of anomalies

NGFWs enhance security by providing deeper insights into network traffic.

Question 4

What details are typically found in firewall log entries?

Answer 4

Time and date, source IP, MAC address, destination IP, application used, disposition

Each entry represents a separate flow of traffic.

Question 5

Where can you find log files on a Windows system?

Answer 5

Windows Event Viewer, specifically the application log section

Log files from applications are crucial for security analysis.

Question 6

What is a Security Information and Event Manager (SIEM)?

Answer 6

A system that aggregates and analyzes log data from various sources

SIEMs help in correlating security events across the network.

Question 7

What types of log information can endpoint devices provide?

Answer 7

Log in/out events, system events, password changes, directory services information

Endpoint logs are essential for tracking user activity and security events.

Question 8

What security events can operating system log files help monitor?

Answer 8

Brute force attacks, changes to critical system files, authentication events

These logs can signal potential security breaches.

Question 9

True or False: Only the network devices generate log files.

Answer 9

False

Log files are generated by endpoints, applications, and operating systems as well.

Question 10

What information can Intrusion Prevention Systems (IPS) logs provide?

Answer 10

Known vulnerabilities, types of attacks, source and destination IP addresses

IPS logs are crucial for identifying and responding to threats.

Question 11

What can network infrastructure devices log?

Answer 11

Routing table changes, authentication errors, network attacks

Logs from switches, routers, and access points are vital for network security.

Question 12

Fill in the blank: The logs from vulnerability scans can identify devices without a _______.

Answer 12

firewall configured

Vulnerability scans help in assessing the security posture of devices.

Question 13

What type of data can be extracted from document metadata?

Answer 13

File descriptions, creator information, device details, GPS coordinates

Metadata can reveal details about how and where a file was created.

Question 14

What are some examples of information found in email headers?

Answer 14

IP addresses, SPF information, transfer process details

Email headers provide insight into the origins and routes of emails.

Question 15

What challenges can arise when generating reports from a SIEM?

Answer 15

Data overload, report relevance, processing power requirements

Organizations may struggle to effectively utilize the data stored in SIEMs.

Question 16

What should organizations do with automated reports generated by SIEMs?

Answer 16

Read and analyze them

Ignoring reports can lead to missed security alerts and issues.

Question 17

What is a key consideration when generating reports from a SIEM?

Answer 17

Finding the right mix between the type of report needed and the time it takes to create it.

Question 18

What can the extensive amount of data in a SIEM lead to when generating reports?

Answer 18

It may require extensive processing power and time.

Question 19

What is a benefit of having a summary of information available at a glance?

Answer 19

It allows for quicker insights rather than waiting for detailed reports.

Question 20

How can dashboards in SIEMs be customized?

Answer 20

They can be customized by the user or come with predefined templates.

Question 21

What type of information is typically displayed on a security operations center dashboard?

Answer 21

Current system status, active firewall rules, warnings, and information about users and devices.

Question 22

Why is long-term data often not shown on dashboards?

Answer 22

Because compiling long-term data takes too long.

Question 23

What is one of the best sources for gathering network data?

Answer 23

The network itself.

Question 24

What utility is mentioned for analyzing packets on a network?

Answer 24

Wireshark.

Question 25

What can Wireshark capture data from?

Answer 25

Both wired and wireless networks.

Question 26

What type of devices may have the ability to capture packets internally?

Answer 26

Devices like switches, routers, or firewalls.

Question 27

What does packet capture provide detailed information about?

Answer 27

Traffic flows at the packet level.

Question 28

What is shown in the Wireshark summary view?

Answer 28

A packet by packet breakdown of everything being sent over the network.

Question 29

What type of traffic is highlighted in the Wireshark example?

Answer 29

HTTP traffic.

Question 30

What command is visible in the packet capture for HTTP traffic?

Answer 30

GET command.

Question 31

What does the detail pane in Wireshark provide?

Answer 31

A breakdown of the highlighted frame, including Ethernet data, IPv4 header, TCP header, and HTTP data.