Chapter 12. Monitoring and Auditing

Which of the following is a record of the tracked actions of users?

• Performance Monitor
• Audit Trails
• Permissions
• System and event logs

What tool can alert you if a server’s processor trips a certain threshold?

• TDR
• Password cracker
• Event Viewer
• Performance Monitor

The IT director has asked you to install agents on several client computers and monitor them from a program at a server. What is this known as?

• SNMP
• SMTP
• SMP
• Performance Monitor

One of your co-workers complains to you that he cannot see any security events in the Event Viewer. What are three possible reasons for this? (Select the three best answers.)

• Auditing has not been turned on, The log file is only 512KB, The co-worker is not an administrator
• The log file is only 512KB, The co-worker is not an administrator, Auditing for an individual object has not been turned on.
• The co-worker is not an administrator, Auditing for an individual object has not been turned on, Auditing for an individual object has not been turned on.

Which tool can be instrumental in capturing FTP GET requests?

• Vulnerability scanner
• Port scanner
• Performance monitor
• Protocol analyzer

Your manager wants you to implement a type of intrusion detection system (IDS) that can be matched to certain types of traffic patterns. What kind of IDS is this?

• Anomaly-based IDS
• Signature-based IDS
• Behavior-based IDS
• Heuristic-based IDS

You are setting up auditing on a Windows computer. If set up properly, which log should have entries?

• Application log
• System log
• Security log
• Maintenance log

You have established a baseline for your server. Which of the following is the best tool to use to monitor any changes to that baseline?

• Performance Monitor
• Anti-spyware
• Antivirus software
• Vulnerability assessments software

In what way can you gather information from a remote printer?

• HTTP
• SNMP
• CA
• SMTP

Which of the following can determine which flags are set in a TCP/IP handshake?

• Protocol analyzer
• Port scanner
• SYN/ACK
• Performance Monitor