SOC › Module 4 › Lesson 5
Quiz — Sources
10 APPLY items on Windows, Linux, and network/proxy logs on $SOC_LAB.
Opening
Log Sources — Module Quiz
Ten APPLY items. Name log source fields on YOUR $SOC_LAB samples — never live brute force, stranger server access, or real phishing delivery. Original Cyberlium. Next: Rule Anatomy.
Knowledge Check
APPLY: Windows Event ID 4625 means:
Multiple choice
Knowledge Check
APPLY: True or False: Logon Type helps distinguish interactive vs network logons.
True or False
Knowledge Check
APPLY: Linux 'Failed password' lines often indicate:
Multiple choice
Knowledge Check
APPLY: Tutorial SSH-scans live IPs for log practice — you:
Multiple choice
Knowledge Check
APPLY: Proxy logs help analysts see:
Multiple choice
Knowledge Check
APPLY: Multi-source triage improves when:
Multiple choice
Knowledge Check
APPLY: Cyberlium NEVER allows:
Multiple choice
Knowledge Check
APPLY: True or False: sudo logs record privileged commands.
True or False
Knowledge Check
APPLY: chmod 600 on source notes means:
Multiple choice
Knowledge Check
APPLY: Next lesson after this quiz:
Multiple choice
Answer all 10 knowledge checks to continue. (0/10 answered)