CND CND Security Operations & Monitoring 2

Question 1

In security monitoring, what does the term 'false positive' refer to?

Accepted Answer

An alert triggered by legitimate activity that is incorrectly flagged as malicious

Answer

A false positive occurs when a security tool generates an alert for benign activity, incorrectly classifying it as a threat, which wastes analyst time and contributes to alert fatigue.

Question 2

Which network monitoring technique captures a copy of all traffic passing through a network segment for analysis without impacting traffic flow?

Accepted Answer

Passive network sniffing via SPAN/mirror port

Answer

A SPAN (Switched Port Analyzer) or mirror port copies traffic from monitored ports to an analysis port, allowing security tools to inspect all traffic passively without affecting network performance.

Question 3

What is threat hunting in a security operations context?

Accepted Answer

Proactive searching through networks and endpoints to detect threats that evade automated detection

Answer

Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.

Question 4

Which Syslog severity level (RFC 5424) indicates conditions that must be corrected immediately, such as a corrupted system database?

Accepted Answer

Level 1 - Alert

Answer

Syslog severity Level 1 (Alert) indicates conditions that require immediate action, such as a loss of the primary ISP link or a corrupted database that needs instant attention.

Question 5

What is the primary benefit of implementing a centralized log management solution (like a SIEM) over reviewing logs on individual systems?

Accepted Answer

It enables cross-system correlation to identify attack patterns spanning multiple devices

Answer

Centralized log management allows security analysts to correlate events across multiple systems, making it possible to detect multi-stage attacks that would appear innocuous when viewed in isolation on individual devices.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND CND Security Operations & Monitoring 2