CND Security Operations & Monitoring Flashcards

What is the purpose of a playbook (runbook) in a Security Operations Center?

Answer: A documented, step-by-step procedure for responding to specific types of security incidents

SOC playbooks provide analysts with standardized, repeatable procedures for responding to specific incident types, ensuring consistent, efficient responses and reducing the chance of missed steps during high-pressure situations.

Which concept describes using SIEM correlation rules to detect when a user logs in from two geographically impossible locations within a short time period?

Answer: Impossible travel detection

Impossible travel detection is a SIEM use case that flags authentications from geographically distant locations within a timeframe that would be physically impossible, indicating credential compromise.

What does UEBA (User and Entity Behavior Analytics) add to traditional SIEM capabilities?

Answer: Machine learning-based detection of anomalous behavior patterns for users and devices

UEBA uses machine learning to build behavioral baselines for users and entities, detecting deviations that may indicate insider threats, compromised accounts, or advanced persistent threats that evade signature-based detection.

In security monitoring, what is the difference between an event and an incident?

Answer: An event is any observable occurrence; an incident is an event that negatively impacts or threatens security

A security event is any observable activity in a system or network, while a security incident is a confirmed or suspected event that has or could adversely affect the confidentiality, integrity, or availability of information.

What is the primary purpose of implementing log retention policies in a security operations program?

Answer: To ensure logs are available for forensic investigation, compliance requirements, and long-term trend analysis

Log retention policies define how long logs must be kept to support forensic investigations after a breach, satisfy regulatory compliance mandates (e.g., PCI-DSS, HIPAA), and enable historical trend analysis.

Which security monitoring approach uses pre-defined signatures or rules to identify known attack patterns, and what is its primary limitation?

Answer: Signature-based detection; cannot detect unknown or zero-day attacks

Signature-based detection is effective against known threats but cannot detect novel zero-day exploits or attacks that haven't been cataloged in the signature database, making it reactive rather than proactive.