Deck 18: Security Auditing

Question 1

Data representing behavior that does not trigger an alarm cannot serve
as input to intrusion detection analysis.

Answer 1

False

Question 2

The ________ is a module that transmits the audit trail records from its local system to the centralized audit trail collector.

A)audit dispatcher
B)audit analyzer
C)audit trail collector
D)none of the above

Answer 2

A

Question 3

The ________ is a module on a centralized system that collects audit trail records from other systems and creates a combined audit trail.

A)audit dispatcher
B)audit analyzer
C)audit trail collector
D)audit provider

Answer 3

C

Question 4

A _______ is conducted to determine the adequacy of system controls,ensure compliance with established security policy and procedures,detect breaches in security services,and recommend any changes that are indicated for countermeasures.

A)security audit trail
B)security audit
C)user-level audit
D)system-level audit trail

Question 5

Means are needed to generate and record a security audit trail and to
review and analyze the audit trail to discover and investigate attacks and security compromises.

Question 6

Although important,security auditing is not a key element in computer
security.

Question 7

Audit trails are different from audit logs.

Question 8

Protection of the audit trail involves both integrity and confidentiality.

Question 9

Event and audit trail analysis software,tools,and interfaces may be
used to analyze collected data as well as for investigating data trends and anomalies.

Question 10

The foundation of a security auditing facility is the initial capture of
the audit data.

Question 11

Thresholding is a form of baseline analysis.

Question 12

The audit analyzer prepares human-readable security reports.

Question 13

The basic audit objective is to establish accountability for system
entities that initiate or participate in security-relevant events and actions.

Question 14

The _________ is logic embedded into the software of the system that monitors system activity and detects security-related events that it has been configured to detect.

A)event discriminator
B)audit analyzer
C)archive
D)alarm processor

Question 15

Security auditing can:

A)provide data that can be used to define anomalous behavior
B)maintain a record useful in computer forensics
C)generate data that can be used in after-the-fact analysis of an attack
D)all of the above

Question 16

Applications,especially applications with a certain level of privilege,
present security problems that may not be captured by system-level or user-level auditing data.

Question 17

All UNIX implementations will have the same variants of the syslog
facility.

Question 18

The first order of business in security audit trail design is the selection
of data items to capture.

Question 19

According to ISO 27002,the person(s)carrying out the audit should be
independent of the activities audited.

Question 20

The security administrator must define the set of events that are
subject to audit.

Question 21

______ software is a centralized logging software package similar to,but much more complex than,syslog.

A)NetScan
B)McAfee
C)IPConfig
D)SIEM

Question 22

Windows is equipped with three types of event logs: system event log,security event log,and ________ event log.

Question 23

_________ audit trails may be used to detect security violations within an application or to detect flaws in the application's interaction with the system.

A)Application-level
B)System-level
C)User-level
D)None of the above

Question 24

_________ identifies the level of auditing,enumerates the types of auditable events,and identifies the minimum set of audit-related information provided.

A)Event selection
B)Data generation
C)Automatic response
D)Audit analysis

Question 25

Windows allows the system user to enable auditing in _______ different categories.

A)five
B)seven
C)nine
D)eleven

Question 26

With _________ the linking to shared library routines is deferred until load time so that if changes are made any program that references the library is unaffected.

A)statically linked shared libraries
B)dynamically linked shared libraries
C)system linked shared libraries
D)all of the above

Question 27

System conditions requiring immediate attention is a(n)_______ severity.

A)alert
B)err
C)notice
D)emert

Question 28

The audit _______ are a permanent store of security-related events on a system.

Question 29

A _______ is an independent review and examination of a system's records and activities.

Question 30

A _________is a chronological record of system activities that is sufficient to enable the reconstruction and examination of the sequence of environments and activities surrounding or leading to an operation,procedure,or event in a security-relevant transaction from inception to final results.

Question 31

_________ audit trails are generally used to monitor and optimize system performance.

A)User-level
B)Physical-level
C)System-level
D)All of the above

Question 32

Data items to capture for a security audit trail include:

A)events related to the security mechanisms on the system
B)operating system access
C)remote access
D)all of the above

Question 33

______ is the identification of data that exceed a particular baseline value.

A)Anomaly detection
B)Real-time analysis
C)Thresholding
D)All of the above

Question 34

Severe messages,such as immediate system shutdown,is a(n)_____ severity.

A)alert
B)emerg
C)crit
D)warning

Question 35

______ is UNIX's general-purpose logging mechanism found on all UNIX variants and Linux.

Question 36

RFC 2196 (Site Security Handbook)lists three alternatives for storing audit records: read/write file on a host,write-once/read-many device,and ______.

Question 37

________ audit trail traces the activity of individual users over time and can be used to hold a user accountable for his or her actions.

Question 38

Monitoring areas suggested in ISO 27002 include: authorized access,all privileged operations,unauthorized access attempts,changes to (or attempts to change)system security settings and controls,and __________.

Question 39

_________ is a form of auditing that focuses on the security of an organization's IS assets.

Question 40

The ________ is an application or user who examines the audit trail and the audit archives for historical trends,for computer forensic purposes,and for other analysis.

Question 41

SIEM software has two general configuration approaches: agentless and ______.

Question 42

______ is the process of defining normal versus unusual events and patterns.

Question 43

Messages in the BSD syslog format consist of three parts: PRI,Header,and ___.

Question 44

The ______ repository contains the auditing code to be inserted into an application.

Question 45

______ is detection of events within a given set of parameters,such as within a given time period or outside a given time period.