Chapter 9 Audit Log

What do audit logs take note of within a system?

• Unfavorable events

• Recovery processes

• Every change within a system

• Only security breaches

What is an audit trail?

• A system function

• A series of records of computer events

• A specific security breach

• A type of virus

What is an audit record?

• A single entry in an audit log describing an auditable event

• A system configuration

• A log of user activities

• A security incident report

What do audit logs provide proof of to auditors?

• Compliance with privacy laws

• Data encryption

• Network speed

• Hardware maintenance

What should organizations look for in network security auditing tools?

• Device configuration tamper encouragement

• Manual asset discovery

• Full activity logging for data protection standards compliance

• Automated vulnerability assessors only

Which auditing tool is designed for sysadmins to audit their network and deploy configuration changes?

• N-able N-sight

• Intruder

• ManageEngine Log360

• SolarWinds Network Configuration Manager

What do audit reduction tools do?

• Facilitate manual review by reducing the volume of audit records

• Detect attack signatures

• Increase the volume of audit records

• Detect anomalies in user behavior

What do trends/variance-detection tools look for?

• Anomalies in tools

• System configuration changes

• Attack signatures

• Usage trends and major variations

Which auditing tool is a cloud-based vulnerability scanner?

• Nmap

• ManageEngine Event Log Analyzer

• Intruder

• SolarWinds Network Configuration Manager

What do attack signature-detection tools look for?

• Specific sequence of events indicative of an unauthorized access attempt

• System configuration changes

• Anomalies in user behavior

• Usage trends