ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 744 - N10-008 discussion

Report
Export

A network security engineer is responding to a security incident. The engineer suspects that an attacker used an authorized administrator account to make configuration changes to the boundary firewall. Which of the following should the network security engineer review?

A.
Network traffic logs
Answers
A.
Network traffic logs
B.
Audit logs
Answers
B.
Audit logs
C.
Syslogs
Answers
C.
Syslogs
D.
Event logs
Answers
D.
Event logs
Suggested answer: B

Explanation:

Audit logs are records of the actions performed by users or processes on a system or network device. They can provide information about who made what changes, when, and why. Audit logs are essential for detecting and investigating security incidents, as well as for ensuring compliance with policies and regulations. Audit logs can help the network security engineer to identify the source of the unauthorized configuration changes to the boundary firewall, as well as the scope and impact of the changes.

Reference 1- Changes to Cyber Essentials requirements -- April 2021 update 2- 8 Firewall Best Practices for Securing the Network 3- How to secure your network boundaries with a firewall

asked 02/10/2024
Jose Leston
41 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first