CND Security Operations & Monitoring Flashcards

What is the primary function of a Security Information and Event Management (SIEM) system?

Answer: To aggregate and correlate security event logs from multiple sources for analysis

A SIEM collects, normalizes, and correlates log data from diverse sources (firewalls, IDS, servers) to provide real-time security monitoring, alerting, and forensic analysis.

In a SOC (Security Operations Center), what is the role of a Tier 1 analyst?

Answer: Monitoring alerts, triaging events, and escalating confirmed incidents

Tier 1 SOC analysts monitor security dashboards, review and triage incoming alerts, filter false positives, and escalate validated incidents to Tier 2 for deeper investigation.

Which log source is most critical for detecting brute force login attempts against Windows Active Directory?

Answer: Windows Security Event Logs (Event ID 4625)

Windows Security Event ID 4625 records failed logon attempts, and repeated failures from a single source against AD accounts are the primary indicator of a brute force attack.

What is baseline monitoring in the context of network security operations?

Answer: Establishing normal network behavior patterns to identify anomalies

Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.

Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?

Answer: Mean Time to Detect (MTTD)

Mean Time to Detect (MTTD) measures the average duration between the start of a security incident and its detection by the SOC, with lower values indicating better monitoring effectiveness.

What is the purpose of log normalization in a SIEM system?

Answer: Converting logs from different sources into a common format for correlation

Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.