A Data Protection Solution Example, IBM Security Guardium Use Cases

 #cybersecurity #coursera #quiz #solution #network 

1.

Question 1

In setting up policy rules for data monitoring, what is the purpose of "exclude" rules?

1 / 1 point

To exclude certain commands from being executed.

To exclude someone from accessing certain database tables.

To exclude certain applications or safe activities from being logged.

To exclude individual accounts from accessing data.

Correct

Correct, To exclude certain applications or safe activities from being logged.

2.

Question 2

True or False: Data monitoring products such as IBM Guardium can send access alerts to syslog for manual intervention by a security analyst but must be connected to addition applications if automated interventions are desired.

1 / 1 point

True

False

Correct

Correct

3.

Question 3

To created auditable reports of data access using the IBM Guardium product, the administrator would do which of the following?

1 / 1 point

Use the Audit Process Builder feature to automate the reporting process.

All standard reports are considered auditable.

Export standard access logs to Excel or another reporting tool for sorting and processing.

Develop a custom report and turn on Audit Locking to assure the results cannot be tampered with.

Correct

Correct, All standard reports are considered auditable.

4.

Question 4

True or False: The IBM Guardium monitoring applications is capable of monitoring activities in non-relational databases such as Hadoop, Cognos, and Spark.

1 / 1 point

True

False

Correct

Correct

5.

Question 5

At a minimum, which 3 entities should be captured in any event log?

1 / 1 point

What activity took place.

Correct

Partially correct, you answered one of the three.

Whether the attempted activity was completed successfully.

Which database tables were associated with the activity.

Who or what committed the activity.

Correct

Partially correct, you answered one of the three.

When the activity took place.

Correct

Partially correct, you answered one of the three.

6.

Question 6

True of False: In the IBM Guardium data monitoring tool, the number of failed login attempts that would trigger an alert are always counted since the last successful login.

1 / 1 point

True

False

Correct

Correct

7.

Question 7

Which activity should be considered suspicious and might indicate inappropriate activity is being attempted?

1 / 1 point

Data accessed by an accounting application dramatically increases in the last few days of every month.

A known user attempts to run invalid SQL statements against data his ID is authorized to access.

A user routinely enters the incorrect password once or twice before entering the correct password for his account.

Attempts are made to access data using nonstandard tools, such as MS Excel or MS Access, rather than through the application the data belongs to.

Correct

Correct, Attempts are made to access data using nonstandard tools, such as MS Excel or MS Access, rather than through the application the data belongs to.

8.

Question 8

Which two (2) activities should be considered suspicious and warrant further investigation?

1 / 1 point

Use of an Application ID from an IP that is different from what has been specified by the application owner.

Correct

Partially correct, this is one of the correct answers.

It takes an authorized user 3 attempts to enter the correct password.

Use of an Application ID from a hostname that is different from what has been specified by the application owner.

Correct

Partially correct, this is one of the correct answers.

An authorized user attempts to run SQL statements with invalid syntax.