212-82 Exam Dumps : Certified Cybersecurity Technician (CCT)

For NexaCorp to effectively monitor and analyze system logs, implementing a Security Information and Event Management (SIEM) system is the optimal approach:

SIEM Overview: SIEM systems collect, normalize, and analyze log data from various sources in real-time.

Benefits:

Centralization: Aggregates logs from all systems into a single platform.

Correlation: Identifies patterns and correlates events from different sources to detect anomalies.

Implementation Steps:

Select a SIEM Solution: Choose a suitable SIEM tool (e.g., Splunk, ELK Stack, QRadar).

Integration: Configure the SIEM to collect logs from all relevant systems.

Alerting and Reporting: Set up alerts for suspicious activities and generate periodic reports.

References:

SIEM Basics: Link

Implementing SIEM: Link

Recovery is the IH&R step performed by Edwin in the above scenario. IH&R (Incident Handling and Response) is a process that involves identifying, analyzing, containing, eradicating, recovering from, and reporting on security incidents that affect an organization’s network or system. Recovery is the IH&R step that involves restoring the normal operation of the system ornetwork after eradicating the incident. Recovery can include reinstating lost data from the backup media, applying patches or updates, reconfiguring settings, testing functionality, etc. Recovery also involves ensuring that the backup does not have any traces of malware or compromise . Eradication is the IH&R step that involves removing all traces of the incident from the system or network, such as malware, backdoors, compromised files, etc. Incident containment is the IH&R step that involves implementing appropriate measures to stop the infection from spreading to other organizational assets and to prevent further damage to the organization. Notification is the IH&R step that involves informing relevant stakeholders, authorities, or customers about the incident and its impact. 

A circuit-level gateway is a type of firewall that works at the session layer of the OSI model and monitors the TCP handshake between hosts to determine whether a requested session is legitimate. It does not inspect the contents of each packet, but rather relies on the session information to filter traffic