Eccouncil 312-39 practice test

Where will you find the reputation IP database, if you want to monitor traffic from known bad IP
reputation using OSSIM SIEM?

• A. /etc/ossim/reputation
• B. /etc/ossim/siem/server/reputation/data
• C. /etc/siem/ossim/server/reputation.data
• D. /etc/ossim/server/reputation.data

According to the Risk Matrix table, what will be the risk level when the probability of an attack is very
low and the impact of that attack is major?

• A. High
• B. Extreme
• C. Low
• D. Medium

Which of the following command is used to view iptables logs on Ubuntu and Debian distributions?

• A. $ tailf /var/log/sys/kern.log
• B. $ tailf /var/log/kern.log
• C. # tailf /var/log/messages
• D. # tailf /var/log/sys/messages

Which of the following technique involves scanning the headers of IP packets leaving a network to
make sure
that the unauthorized or malicious traffic never leaves the internal network?

• A. Egress Filtering
• B. Throttling
• C. Rate Limiting
• D. Ingress Filtering

Which of the following formula is used to calculate the EPS of the organization?

• A. EPS = average number of correlated events / time in seconds
• B. EPS = number of normalized events / time in seconds
• C. EPS = number of security events / time in seconds
• D. EPS = number of correlated events / time in seconds

Juliea a SOC analyst, while monitoring logs, noticed large TXT, NULL payloads.
What does this indicate?

• A. Concurrent VPN Connections Attempt
• B. DNS Exfiltration Attempt
• C. Covering Tracks Attempt
• D. DHCP Starvation Attempt

An organization is implementing and deploying the SIEM with following capabilities.

What kind of SIEM deployment architecture the organization is planning to implement?

• A. Cloud, MSSP Managed
• B. Self-hosted, Jointly Managed
• C. Self-hosted, Self-Managed
• D. Self-hosted, MSSP Managed

What is the process of monitoring and capturing all data packets passing through a given network
using different tools?

• A. Network Scanning
• B. DNS Footprinting
• C. Network Sniffing
• D. Port Scanning

Which of the following is a report writing tool that will help incident handlers to generate efficient
reports on detected incidents during incident response process?

• A. threat_note
• B. MagicTree
• C. IntelMQ
• D. Malstrom

Which of the following Windows features is used to enable Security Auditing in Windows?

• A. Bitlocker
• B. Windows Firewall
• C. Local Group Policy Editor
• D. Windows Defender