CYB 401: Software and Systems Security: Test 2

What is the primary purpose of a Security Information and Event Management (SIEM) solution?

• To replace all traditional security tools

• To analyze and correlate logs for threat detection

• To store passwords securely

• To create network firewall rules

Which type of log is most commonly used for detecting unauthorized access attempts?

• System logs

• Authentication logs

• Print logs

• Application logs

What is a common use case for log review in cybersecurity?

• Identifying performance issues

• Detecting security incidents

• Monitoring software licenses

• Generating marketing reports

What is a major benefit of centralized log management in SIEM solutions?

• Increased storage costs

• Simplified correlation and analysis

• Decreased system performance

• Manual event correlation

Which of the following logs is most useful for tracking user logins and logouts?

• Firewall logs

• System logs

• Security logs

• Database logs

What is the main challenge of implementing SIEM solutions?

• Lack of logs

• High initial costs and complexity

• Limited storage capacity

• Low CPU usage

What is the first step in a digital forensic investigation?

• Analysis

• Data acquisition

• Reporting

• Identification

Which of the following is considered volatile data in digital forensics?

• Hard drive data

• RAM contents

• USB device files

• Archived emails

What type of forensic analysis focuses on deleted files and partitions?

• Network forensics

• File system forensics

• Cloud forensics

• Database forensics

What is the purpose of a write blocker in digital forensics?

• To prevent malware infection

• To avoid accidental data modification

• To enhance processing speed

• To delete sensitive data