Answer the following questions and also justify your answers with appropriate examples
Question 1: Windows Task Manager and Windows Computer Manager both provide information about system services. Compare and contrast the types of information (about system services) that can be obtained from these tools.
Question 2: Describe how you could use one or more of the Windows log files to investigate a potential malware infection on a system.
- What types of information are available to you in your chosen log file?
Question 3: Should you filter log files during an investigation into a security incident? Why or why not?
Question 4: Should remote desktop services be enabled on employee workstations for use by IT Help Desk personnel? Why or why not?
Question 5: What is system hardening? Explain the relationship between system hardening and the removal or mitigation of vulnerabilities.
Question 6: What resources are available on the Internet to help system administrators determine how to harden a Windows Server 2008? Windows 7 workstation?
Question 7: How does Microsoft Baseline Security Analyzer (MBSA) differ from Windows Update? Why are Shares a source of system vulnerabilities?
Question 8: What did the Nessus scan report tell you about vulnerabilities on the network segment that was scanned?
Question 9: After an incident responder has finished gathering information about a security incident, what should be the next step(s)?