Quiz — Sources
10 APPLY items on Windows, Linux, and network/proxy logs on $SOC_LAB.
Log Sources — Module Quiz
Ten APPLY items. Name log source fields on YOUR $SOC_LAB samples — never live brute force, stranger server access, or real phishing delivery. Original Cyberlium. Next: Rule Anatomy.
APPLY: Windows Event ID 4625 means:
APPLY: True or False: Logon Type helps distinguish interactive vs network logons.
APPLY: Linux 'Failed password' lines often indicate:
APPLY: Tutorial SSH-scans live IPs for log practice — you:
APPLY: Proxy logs help analysts see:
APPLY: Multi-source triage improves when:
APPLY: Cyberlium NEVER allows:
APPLY: True or False: sudo logs record privileged commands.
APPLY: chmod 600 on source notes means:
APPLY: Next lesson after this quiz: