CAS-003 · Question #963
A manufacturing firm has multiple security appliances m production that were configured to log events but have not been maintained or tuned. A security engineer discovers multiple email messages…
The correct answer is C. Configure the Apache server to send syslog to a log collector. The scenario describes security appliances sending automated alert emails to a mailbox belonging to a former employee, indicating that log alerting is improperly configured with a hardcoded individual recipient. The appliance in question in this context is an Apache web server…
Question
A manufacturing firm has multiple security appliances m production that were configured to log events but have not been maintained or tuned. A security engineer discovers multiple email messages were automatically generated and sent to the inbox of an employee who has not worked for the firm in more than six months. The messages are as follows:
Which of the following integrations would be BEST to improve the alerting functionality of this particular security appliance?
Options
- AConfigure the IPS to send alerts to a SIEM platform.
- BConfigure the WAF to send alerts to a tog collector
- CConfigure the Apache server to send syslog to a log collector
- DConfigure the WAP to send syslog to a SlEM platform
How the community answered
(52 responses)- A10% (5)
- B2% (1)
- C83% (43)
- D6% (3)
Explanation
The scenario describes security appliances sending automated alert emails to a mailbox belonging to a former employee, indicating that log alerting is improperly configured with a hardcoded individual recipient. The appliance in question in this context is an Apache web server generating security events. The best improvement is to configure Apache to send syslog output to a centralized log collector rather than routing alerts to individual email addresses. A log collector (and ideally a SIEM) provides centralized, role-based access to alerts without dependency on any individual employee's inbox. This prevents the gap that occurred when the employee left. Options A and B may apply in other contexts but do not address the identified Apache server alert routing problem. Option D references a WAP (wireless access point), which is not the source of the described alerts.
Topics
Community Discussion
No community discussion yet for this question.