Exam 12: Security Through Monitoring and Auditing

File locks are open communication links between two processes on the server or between the server and a client.

In Network Monitor the capture store is the amount of RAM and virtual memory that is used to store captured data.

In Red Hat Linux, the Emacs and vi editors can be used to configure the syslog.conf file.

Network-based intrusion-detection software is used on a computer or network device and typically places the NIC on that device in ____________________ mode.

Which passive intrusion-detection tool audits activities on multiple operating systems, filters them, and collects the information into one large database for analysis of intrusions?

In Windows Server 2003, the ____________________ log records information about logon accesses and file, folder, and system policy changes.

In the event log, a notice that a service has started would be indicated with what type of symbol?

An inspector is an IDS that tracks a full range of data and events related to an operating system or network.

Understanding the normal conditions for operating systems and a network is accomplished by establishing baselines .

Which of the following activities are usually looked for using passive intrusion-detection tools?

What two useful tools does NetWare offers to view user connections?

In Mac OS X, the FTP Log keeps track of file uploads, downloads, and communications with FTP servers.

Which Network Monitor statistic shows total traffic in frames for broadcasts, unicasts, and multicasts?

Gathering performance statistics each time a new software application is installed, on slow, average, and peak periods during its use, and tracking how many users are on that software is an example of acquiring a _____.

At minimum, active intrusion detection alerts a server or network administrator about an attack or intrusion, so the administrator can take action.

In event log, a warning that a CD-ROM is not loaded would be indicated by what type of symbol?

Which of the following are examples of active intrusion-detection tools?

In Windows Server 2003 event viewer, an informational message such as a notice that a service has been started is prefaced by a black "!" (exclamation point) that appears on a yellow caution symbol.

Is the Process Viewer used by Linux Red Hat 9.x to display a listing of processes and the users who are running those processes?

Are the Server logs for Mac OS X automatically rotated?