CND CND Security Operations & Monitoring 1 — Questions and Answers
Question 1: What is the primary function of a Security Information and Event Management (SIEM) system?
- To encrypt communications between endpoints
- To aggregate and correlate security event logs from multiple sources for analysis (Correct answer)
- To automatically patch vulnerabilities across the network
- To manage user access control policies
Correct answer: To aggregate and correlate security event logs from multiple sources for analysis
A SIEM collects, normalizes, and correlates log data from diverse sources (firewalls, IDS, servers) to provide real-time security monitoring, alerting, and forensic analysis.
Question 2: In a SOC (Security Operations Center), what is the role of a Tier 1 analyst?
- Performing threat hunting and advanced forensics
- Monitoring alerts, triaging events, and escalating confirmed incidents (Correct answer)
- Developing new detection rules and SIEM use cases
- Managing executive-level security reporting
Correct answer: Monitoring alerts, triaging events, and escalating confirmed incidents
Tier 1 SOC analysts monitor security dashboards, review and triage incoming alerts, filter false positives, and escalate validated incidents to Tier 2 for deeper investigation.
Question 3: Which log source is most critical for detecting brute force login attempts against Windows Active Directory?
- Application event logs
- Windows Security Event Logs (Event ID 4625) (Correct answer)
- DNS query logs
- DHCP lease logs
Correct answer: Windows Security Event Logs (Event ID 4625)
Windows Security Event ID 4625 records failed logon attempts, and repeated failures from a single source against AD accounts are the primary indicator of a brute force attack.
Question 4: What is baseline monitoring in the context of network security operations?
- Documenting all installed software versions
- Establishing normal network behavior patterns to identify anomalies (Correct answer)
- Running daily vulnerability scans against all systems
- Creating backup copies of network configurations
Correct answer: Establishing normal network behavior patterns to identify anomalies
Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.
Question 5: Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?
- Mean Time to Recover (MTTR)
- Mean Time to Detect (MTTD) (Correct answer)
- Mean Time Between Failures (MTBF)
- Recovery Time Objective (RTO)
Correct answer: Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) measures the average duration between the start of a security incident and its detection by the SOC, with lower values indicating better monitoring effectiveness.
Question 6: What is the purpose of log normalization in a SIEM system?
- Deleting old logs to free storage space
- Converting logs from different sources into a common format for correlation (Correct answer)
- Encrypting logs to prevent tampering
- Forwarding alerts to the incident response team
Correct answer: Converting logs from different sources into a common format for correlation
Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.
CND CND Security Operations & Monitoring 1
What is the primary function of a Security Information and Event Management (SIEM) system?