CYB 310 : Module Four Lab Worksheet Guidelines ...
Module Four Lab Worksheet Guidelines
Overview
These labs represent skills and tasks that a network administrator will routinely perform. It is extremely important for a practitioner to have skills in these areas to inform security policy and procedures.
Review your worksheet template and complete the subsequent labs:
Identifying and Analyzing Network Host Intrusion Detection System Alerts
Intrusion Detection Using Snort
Detecting Malware and Unauthorized Devices
Prompt
Complete the Module Four Lab Worksheet, which is linked in the Lab Worksheet assignment in Module Four of your course.
What to Submit
Submit your completed worksheet. Use a file name that includes the course code, the assignment title, and your name—for example, CYB_123_Assignment_Firstname_Lastname.docx.
Module Four Lab Worksheet Word Document
Lab: Identifying & Analyzing Network Host Intrusion Detection System Alerts
Prompt
Response
In the lab, “Analyzing Network Events Using Snorby,” Step 18, take a screenshot of the alert window showing signature information and TCP header information.
[Insert screenshot here.]
In the lab section, “Network Security Monitoring with Squert,” in the lab, “Analyzing Network Events Using Squert,” Step 11, take a screenshot of the Squert window displaying filtered scans for ip 203.0.113.2.
[Insert screenshot here.]
In the lab section, “Network Security Monitoring with Squert,” in the lab, “Analyzing Network Events Using Squert,” Step 17, take a screenshot of the Squert window displaying no results when filtering events for ip 10.1.1.10.
[Insert screenshot here.]
There are a variety of network analyzers. Which tool did you feel was the most powerful and easiest to use?
[Insert short response here.]
Why is it important to add network analyzer tools to your cybersecurity analyst skill set?
[Insert short response here.]
How will you use network analyzer tools in a professional manner?
[Insert short response here.]
Lab: Intrusion Detection Using Snort
Prompt
Response
In the lab section, “Setting up the Sniffer,”Step 19, type your name after the command prompt and take a screenshot of the output after running the tcpdump -i eth1 command.
[Insert screenshot here.]
In the lab section, “Detecting Unwanted Incoming Attacks,” Step 9, take a screenshot of the results in the Bruter window after it has cycled through the dictionary words.
[Insert screenshot here.]
In the lab, “Detecting Unwanted Outgoing Traffic,”Step 6, type your name at the command prompt and take a screenshot of the output of the payload generated.
[Insert screenshot here.]
How can you see what options are available for the tcpdump command? How can this tool be used by a security analyst?
[Insert short response here.]
What command will display all of the Ethernet interfaces within Linux? How can this be valuable to a security analyst?
[Insert short response here.]
Detecting Malware and Unauthorized Devices
Prompt
Response
In the lab, “Keyloggers,”Step 6, scroll up to the prompt where you the nmap command and take a screenshot of the output from the scan. Be sure to include the timestamp at the top (date and time).
[Insert screenshot here.]
In the lab, “Keyloggers,”Step 21, take a screenshot of the successful migration after running the migrate command. Note: The number you use will be different from the one in the example.
[Insert screenshot here.]
In the lab, “Keyloggers,”Step 30, take a screenshot of the output after running the kerberos command. Scroll up to the prompt where you typed the command and include the administrator password in your screenshot to show the success of the keylogger dump.
[Insert screenshot here.]
In the lab, “Examining Malware,” Step 32, take a screenshot of the History tab in Windows Defender showing the quarantined file that was detected.
[Insert screenshot here.]
Explain the difference between active and passive scanning tools and techniques.