CND Security Operations & Monitoring Flashcards

In security monitoring, what does the term 'false positive' refer to?

Answer: An alert triggered by legitimate activity that is incorrectly flagged as malicious

A false positive occurs when a security tool generates an alert for benign activity, incorrectly classifying it as a threat, which wastes analyst time and contributes to alert fatigue.

Which network monitoring technique captures a copy of all traffic passing through a network segment for analysis without impacting traffic flow?

Answer: Passive network sniffing via SPAN/mirror port

A SPAN (Switched Port Analyzer) or mirror port copies traffic from monitored ports to an analysis port, allowing security tools to inspect all traffic passively without affecting network performance.

What is threat hunting in a security operations context?

Answer: Proactive searching through networks and endpoints to detect threats that evade automated detection

Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.

Which Syslog severity level (RFC 5424) indicates conditions that must be corrected immediately, such as a corrupted system database?

Answer: Level 1 - Alert

Syslog severity Level 1 (Alert) indicates conditions that require immediate action, such as a loss of the primary ISP link or a corrupted database that needs instant attention.

What is the primary benefit of implementing a centralized log management solution (like a SIEM) over reviewing logs on individual systems?

Answer: It enables cross-system correlation to identify attack patterns spanning multiple devices

Centralized log management allows security analysts to correlate events across multiple systems, making it possible to detect multi-stage attacks that would appear innocuous when viewed in isolation on individual devices.

In network traffic analysis, what does a sudden spike in ICMP traffic from a single internal host typically indicate?

Answer: A potential ping flood or network reconnaissance sweep

An unusual spike in ICMP traffic from one host often signals a ping sweep for network reconnaissance, a ping flood DoS attack, or malware attempting to map the network.