CND CND Security Operations & Monitoring

Question 1

What is the primary function of a Security Information and Event Management (SIEM) system?

Accepted Answer

To aggregate and correlate security event logs from multiple sources for analysis

Answer

To encrypt communications between endpoints

Answer

To automatically patch vulnerabilities across the network

Answer

To manage user access control policies

Question 2

In a SOC (Security Operations Center), what is the role of a Tier 1 analyst?

Accepted Answer

Monitoring alerts, triaging events, and escalating confirmed incidents

Answer

Performing threat hunting and advanced forensics

Answer

Developing new detection rules and SIEM use cases

Answer

Managing executive-level security reporting

Question 3

Which log source is most critical for detecting brute force login attempts against Windows Active Directory?

Accepted Answer

Windows Security Event Logs (Event ID 4625)

Answer

Application event logs

Answer

DNS query logs

Answer

DHCP lease logs

Question 4

What is baseline monitoring in the context of network security operations?

Accepted Answer

Establishing normal network behavior patterns to identify anomalies

Answer

Documenting all installed software versions

Answer

Running daily vulnerability scans against all systems

Answer

Creating backup copies of network configurations

Question 5

Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Recover (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Time Objective (RTO)

Question 6

What is the purpose of log normalization in a SIEM system?

Accepted Answer

Converting logs from different sources into a common format for correlation

Answer

Deleting old logs to free storage space

Answer

Encrypting logs to prevent tampering

Answer

Forwarding alerts to the incident response team