nerdexam
GIAC

GSNA · Question #317

You are the Network Administrator for a software development company. Your company creates various utilities and tools. You have noticed that some of the files your company creates are getting…

The correct answer is A. Antivirus log. Check the antivirus log and see if it is detecting your file as a virus and deleting it. All antivirus programs have a certain rate of false positives. Since the file is being deleted from all computers, it seems likely that your antivirus has mistakenly identified that file as…

Windows System Auditing

Question

You are the Network Administrator for a software development company. Your company creates various utilities and tools. You have noticed that some of the files your company creates are getting deleted from systems. When one is deleted, it seems to be deleted from all the computers on your network. Where would you first look to try and diagnose this problem?

Options

  • AAntivirus log
  • BIDS log
  • CSystem log
  • DFirewall log

How the community answered

(64 responses)
  • A
    83% (53)
  • B
    9% (6)
  • C
    5% (3)
  • D
    3% (2)

Explanation

Check the antivirus log and see if it is detecting your file as a virus and deleting it. All antivirus programs have a certain rate of false positives. Since the file is being deleted from all computers, it seems likely that your antivirus has mistakenly identified that file as a virus. Answer: D is incorrect. The firewall log can help you identify traffic entering or leaving your network, but won't help with files being deleted. Answer: B is incorrect. An IDS log would help you identify possible attacks, but this scenario is unlikely to be from an external attack. Answer: C is incorrect. Your system log can only tell you what is happening on that individual

Topics

#antivirus logs#file deletion#malware#log analysis

Community Discussion

No community discussion yet for this question.

Full GSNA Practice