CND CND Security Operations & Monitoring

Question 1

What is the primary function of a Security Information and Event Management (SIEM) system?

Accepted Answer

To aggregate and correlate security event logs from multiple sources for analysis

Answer

A SIEM collects, normalizes, and correlates log data from diverse sources (firewalls, IDS, servers) to provide real-time security monitoring, alerting, and forensic analysis.

Question 2

In a SOC (Security Operations Center), what is the role of a Tier 1 analyst?

Accepted Answer

Monitoring alerts, triaging events, and escalating confirmed incidents

Answer

Tier 1 SOC analysts monitor security dashboards, review and triage incoming alerts, filter false positives, and escalate validated incidents to Tier 2 for deeper investigation.

Question 3

Which log source is most critical for detecting brute force login attempts against Windows Active Directory?

Accepted Answer

Windows Security Event Logs (Event ID 4625)

Answer

Windows Security Event ID 4625 records failed logon attempts, and repeated failures from a single source against AD accounts are the primary indicator of a brute force attack.

Question 4

What is baseline monitoring in the context of network security operations?

Accepted Answer

Establishing normal network behavior patterns to identify anomalies

Answer

Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.

Question 5

Which metric in a SOC measures the time from when an attack begins to when the security team first detects it?

Accepted Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Detect (MTTD) measures the average duration between the start of a security incident and its detection by the SOC, with lower values indicating better monitoring effectiveness.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND CND Security Operations & Monitoring