Question 1

SYSCON is a Server Console command that is carried forward from earlier versions of NetWare.

Accepted Answer

False

Question 2

Network-based intrusion-detection software is categorized as host wrappers or host-based agents.

Accepted Answer

Network-based intrusion-detection software monitors network traffic for suspicious activity and is not categorized as host wrappers or host-based agents; those terms apply to host-based intrusion detection systems that operate on individual hosts.

Question 3

In Red Hat Linux 9.x, by default, each log file has four rotation levels, to enable the retention of up to four weeks of information.

Accepted Answer

By default, Red Hat Linux 9.x has four rotation levels for log files, retaining up to four weeks of information.

Question 4

In Windows Server 2003 event viewer, an informational message such as a notice that a service has been started is prefaced by a black "!" (exclamation point) that appears on a yellow caution symbol.

Accepted Answer

An informational message in Windows Server 2003 event viewer is prefaced by a lowercase "i" inside a blue circle. A black exclamation point on a yellow caution symbol typically indicates a warning message.

Question 5

The device log records information about system-related events such as hardware errors, driver problems, and hard drive errors.

Accepted Answer

The answer of The device log records information about system-related...

Question 6

At minimum, active intrusion detection alerts a server or network administrator about an attack or intrusion, so the administrator can take action.

Accepted Answer

Active intrusion detection is designed to alert server or network administrators about potential attacks or intrusions as they are happening, allowing them to take immediate action to contain and mitigate any potential damage. This is in contrast to passive intrusion detection, which simply records and logs potential threats for later analysis.

Question 7

In Mac OS X, the FTP Log keeps track of file uploads, downloads, and communications with FTP servers.

Accepted Answer

The FTP Log in Mac OS X does indeed keep track of file uploads, downloads, and communications with FTP servers.

Question 8

If % Network utilization is frequently over 90 percent, that means the network is experiencing collisions and there may be bottlenecks due to the network design, possibly indicating the need to create more or different subnets.

Accepted Answer

High network utilization over 90 percent does indicate potential bottlenecks and performance issues, but it does not specifically mean that the network is experiencing collisions. Collisions are more associated with older Ethernet technologies using a shared medium (like hub-based Ethernet). Modern Ethernet networks using switches and full-duplex connections do not have collision issues in the same way. The need for more or different subnets can help with network organization and reducing broadcast domains, but it's not directly related to collisions.

Question 9

The Netware 6.x Console Log enables you to trace information, such as NLMs that have been loaded or unloaded, and to trace other activities that have been performed from the console.

Accepted Answer

The Netware 6.x Console Log does enable users to trace information such as NLMs being loaded or unloaded and other activities performed from the console.

Question 10

Network Monitor is a utility which comes with Windows 2000 Server and Windows Server 2003.

Accepted Answer

Network Monitor is a built-in utility in Windows 2000 Server and Windows Server 2003 for capturing and analyzing network traffic.

Question 11

In Red Hat Linux, the Emacs and vi editors can be used to configure the syslog.conf file.

Accepted Answer

Both Emacs and vi can be used to edit the configuration file of syslog, which is a standard logging facility used in UNIX-like operating systems such as Red Hat Linux.

Question 12

SNMP enables network agents to gather information about network performance and send that information to a network management station.

Accepted Answer

SNMP (Simple Network Management Protocol) is a protocol used to manage and monitor network devices. It allows network agents to collect and send information about network performance to a network management station, making it easier to diagnose and resolve problems on the network.

Question 13

An inspector is an IDS that tracks a full range of data and events related to an operating system or network.

Accepted Answer

An inspector in the context of Intrusion Detection Systems (IDS) is not a defined term. IDSs monitor and analyze system or network traffic for suspicious activities and policy violations, not specifically an inspector tracking a full range of data and events.

Question 14

Active intrusion detection is effective as long as the server or network administrator regularly checks the logs and recorded information for possible intrusion attempts.

Accepted Answer

Active intrusion detection systems (IDS) do not merely rely on the manual checking of logs by administrators; they actively monitor the network for suspicious activities and can automatically respond to detected threats, often in real time, without requiring manual intervention for each alert.

Question 15

In Network Monitor the capture store is the amount of RAM and virtual memory that is used to store captured data.

Accepted Answer

The answer of In Network Monitor the capture store is...

Question 16

The default folder for saved Network Monitor capture information in Windows Server 2003 is \WINNT\system32\NETMON\CAPTURES .

Accepted Answer

The default folder for saved Network Monitor capture information in Windows Server 2003 is \Program Files\Network Monitor\Captures, not \WINNT\system32\NETMON\CAPTURES.

Question 17

Understanding the normal conditions for operating systems and a network is accomplished by establishing baselines .

Accepted Answer

Baselines provide a reference point for what is considered "normal" or "expected" behavior in an operating system or network. By establishing baselines, deviations from this norm can be more easily identified and addressed.

Question 18

File locks are open communication links between two processes on the server or between the server and a client.

Accepted Answer

File locks are mechanisms for controlling access to files in a shared environment, ensuring that only one process can modify or read a file at a given time to prevent data corruption or inconsistency.

Question 19

The who command provides information about who is logged on to Red Hat Linux 9.x.

Accepted Answer

The who command is used to display a list of users logged in to the system in Red Hat Linux 9.x.

Question 20

Network Monitor supports event management , which enables a server administrator to set up filters to capture a certain event or type of network activity.

Accepted Answer

Network Monitor does support event management and allows server administrators to set up filters to capture specific events or types of network activity. This can be useful for troubleshooting network issues or monitoring network traffic.

Quiz 12: Security Through Monitoring and Auditing