312-39 Practice Test

Where will you find the reputation IP database, if you want to monitor traffic from known bad IP reputation using OSSIM SIEM?

A.

/etc/ossim/reputation

B.

/etc/ossim/siem/server/reputation/data

C.

/etc/siem/ossim/server/reputation.data

D.

/etc/ossim/server/reputation.data

According to the forensics investigation process, what is the next step carried out right after collecting the evidence?

A.

Create a Chain of Custody Document

B.

Send it to the nearby police station

C.

Set a Forensic lab

D.

Call Organizational Disciplinary Team

Which of the following command is used to enable logging in iptables?

A.

$ iptables -B INPUT -j LOG

B.

$ iptables -A OUTPUT -j LOG

C.

$ iptables -A INPUT -j LOG

D.

$ iptables -B OUTPUT -j LOG

Peter, a SOC analyst with Spade Systems, is monitoring and analyzing the router logs of the company and wanted to check the logs that are generated by access control list numbered 210.
What filter should Peter add to the 'show logging' command to get the required output?

A.

show logging | access 210

B.

show logging | forward 210

C.

show logging | include 210

D.

show logging | route 210

What does the HTTP status codes 1XX represents?

A.

Informational messag

B.

Client error

C.

Success

D.

Redirection