CSOC Network Security Monitoring 2 — Questions and Answers
Question 1: What is DNS monitoring and why is it important for network security?
- Monitoring DNS queries and responses to detect malicious domains, DNS tunnelling, and command-and-control communications (Correct answer)
- Monitoring the availability and performance of DNS servers to prevent outages
- Auditing DNS configuration changes to prevent unauthorised zone modifications
- Tracking which users are accessing external websites for acceptable use policy enforcement
Correct answer: Monitoring DNS queries and responses to detect malicious domains, DNS tunnelling, and command-and-control communications
DNS monitoring is a valuable security technique because attackers frequently use DNS for command-and-control communications, data exfiltration via DNS tunnelling, and accessing malicious domains. Monitoring DNS traffic can reveal these threats.
Question 2: What is NetFlow analysis and how is it used in network security monitoring?
- Analysing metadata about network connections (source, destination, port, volume) to detect anomalous traffic patterns without full packet capture (Correct answer)
- Capturing and inspecting the complete content of all network packets for deep analysis
- Monitoring the flow of data between cloud services and on-premises systems
- Analysing network hardware performance to identify bottlenecks and congestion points
Correct answer: Analysing metadata about network connections (source, destination, port, volume) to detect anomalous traffic patterns without full packet capture
NetFlow analysis uses metadata about network connections rather than full packet content, providing efficient visibility into traffic patterns, unusual volumes, unexpected destinations, and other anomalies that may indicate threats.
Question 3: What is a 'false positive' in the context of network security monitoring?
- An alert generated by a security system for an event that is not actually malicious (Correct answer)
- A successful attack that was incorrectly classified as normal activity
- An attacker who gains access using legitimate credentials
- A vulnerability that cannot be exploited in practice despite existing in theory
Correct answer: An alert generated by a security system for an event that is not actually malicious
A false positive is when a security system incorrectly flags legitimate activity as malicious. High false positive rates waste analyst time and contribute to alert fatigue, potentially causing real threats to be overlooked.
Question 4: What is the purpose of packet capture (PCAP) in network security investigations?
- To capture and record the full content of network packets for detailed forensic analysis of security incidents (Correct answer)
- To capture and display network performance metrics for bandwidth management
- To record which users are sending the most data across the network for billing purposes
- To automatically block packets matching known attack signatures
Correct answer: To capture and record the full content of network packets for detailed forensic analysis of security incidents
Packet capture records the full content of network traffic, providing the most detailed possible evidence for forensic investigations. PCAP data can reveal exactly what data was transmitted, which protocols were used, and what commands were sent by attackers.
Question 5: What is 'east-west traffic' monitoring and why is it important in enterprise networks?
- Monitoring traffic moving laterally between systems within the internal network, which is where attackers move after gaining initial access (Correct answer)
- Monitoring internet-bound traffic leaving the network towards external destinations
- Monitoring traffic flowing between geographically separate data centres in different regions
- Monitoring communications between east and west sides of a data centre floor
Correct answer: Monitoring traffic moving laterally between systems within the internal network, which is where attackers move after gaining initial access
East-west traffic refers to lateral traffic between internal systems within a network. After initial compromise, attackers typically move east-west between internal systems. Monitoring this traffic is critical for detecting lateral movement.
Question 6: What is the role of threat intelligence feeds in a CSOC's network monitoring activities?
- They provide up-to-date information on known malicious IPs, domains, and attack signatures that can be used to improve detection rules (Correct answer)
- They automatically update firewall rules to block all known threats without human intervention
- They provide legal guidance on what network monitoring activities are permitted under Singapore law
- They generate automated incident reports that are submitted to CSA on behalf of the organisation
Correct answer: They provide up-to-date information on known malicious IPs, domains, and attack signatures that can be used to improve detection rules
Threat intelligence feeds provide curated, up-to-date information about known threat actors, malicious infrastructure, and attack signatures. CSOC analysts use this information to enrich their monitoring rules, prioritise alerts, and proactively hunt for threats.
CSOC Network Security Monitoring 2
What is DNS monitoring and why is it important for network security?