CND CND Security Operations & Monitoring 2 — Questions and Answers
Question 1: In security monitoring, what does the term 'false positive' refer to?
- A real attack that was successfully blocked
- An alert triggered by legitimate activity that is incorrectly flagged as malicious (Correct answer)
- A security control that failed to detect an attack
- A vulnerability that has no available patch
Correct answer: An alert triggered by legitimate activity that is incorrectly flagged as malicious
A false positive occurs when a security tool generates an alert for benign activity, incorrectly classifying it as a threat, which wastes analyst time and contributes to alert fatigue.
Question 2: Which network monitoring technique captures a copy of all traffic passing through a network segment for analysis without impacting traffic flow?
- Port scanning
- Passive network sniffing via SPAN/mirror port (Correct answer)
- Active host probing
- ARP broadcasting
Correct answer: Passive network sniffing via SPAN/mirror port
A SPAN (Switched Port Analyzer) or mirror port copies traffic from monitored ports to an analysis port, allowing security tools to inspect all traffic passively without affecting network performance.
Question 3: What is threat hunting in a security operations context?
- Automated scanning of systems for known vulnerabilities
- Proactive searching through networks and endpoints to detect threats that evade automated detection (Correct answer)
- Responding to active security incidents as they are reported
- Running penetration tests against production systems
Correct answer: Proactive searching through networks and endpoints to detect threats that evade automated detection
Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.
Question 4: Which Syslog severity level (RFC 5424) indicates conditions that must be corrected immediately, such as a corrupted system database?
- Level 0 - Emergency
- Level 1 - Alert (Correct answer)
- Level 2 - Critical
- Level 3 - Error
Correct answer: Level 1 - Alert
Syslog severity Level 1 (Alert) indicates conditions that require immediate action, such as a loss of the primary ISP link or a corrupted database that needs instant attention.
Question 5: What is the primary benefit of implementing a centralized log management solution (like a SIEM) over reviewing logs on individual systems?
- It reduces the storage space required for logs
- It enables cross-system correlation to identify attack patterns spanning multiple devices (Correct answer)
- It automatically remediates detected security issues
- It eliminates the need for endpoint security solutions
Correct answer: It enables cross-system correlation to identify attack patterns spanning multiple devices
Centralized log management allows security analysts to correlate events across multiple systems, making it possible to detect multi-stage attacks that would appear innocuous when viewed in isolation on individual devices.
Question 6: In network traffic analysis, what does a sudden spike in ICMP traffic from a single internal host typically indicate?
- Normal DNS resolution activity
- A potential ping flood or network reconnaissance sweep (Correct answer)
- Routine certificate renewal traffic
- Standard operating system update downloads
Correct answer: A potential ping flood or network reconnaissance sweep
An unusual spike in ICMP traffic from one host often signals a ping sweep for network reconnaissance, a ping flood DoS attack, or malware attempting to map the network.
CND CND Security Operations & Monitoring 2
In security monitoring, what does the term 'false positive' refer to?