CCD Log Analysis & Forensics 2

Question 1

Which Windows Event ID indicates a failed logon attempt?

Accepted Answer

4625

Answer

Event ID 4625 is logged when an account fails to log on to a Windows system.

Question 2

A SIEM alert fires on 500 failed SSH logins from one IP in 60 seconds. What attack pattern does this most likely indicate?

Accepted Answer

Brute-force / dictionary attack

Answer

High-volume rapid login attempts against a single service from one source is the hallmark of a brute-force or dictionary attack.

Question 3

In Linux, which log file records authentication events such as sudo usage and SSH logins on Debian-based systems?

Accepted Answer

/var/log/auth.log

Answer

/var/log/auth.log captures PAM, SSH, and sudo authentication events on Debian/Ubuntu systems.

Question 4

During a forensic investigation you find that /etc/passwd was modified at 02:14 AM but no user account changes appear in audit logs. What should you suspect?

Accepted Answer

An attacker modified the file and cleared audit logs

Answer

Missing audit entries combined with unauthorized file modification strongly suggests an attacker edited the file and tampered with or cleared audit logs.

Question 5

What does the 'c' flag in an auditd rule such as '-a always,exit -F arch=b64 -S open -F success=0' indicate?

Accepted Answer

Capture failed system calls

Answer

The '-F success=0' filter tells auditd to record only failed syscalls, useful for detecting unauthorized access attempts.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Log Analysis & Forensics 2