CSOC Network Security Monitoring 2

Question 1

What is DNS monitoring and why is it important for network security?

Accepted Answer

Monitoring DNS queries and responses to detect malicious domains, DNS tunnelling, and command-and-control communications

Answer

DNS monitoring is a valuable security technique because attackers frequently use DNS for command-and-control communications, data exfiltration via DNS tunnelling, and accessing malicious domains. Monitoring DNS traffic can reveal these threats.

Question 2

What is NetFlow analysis and how is it used in network security monitoring?

Accepted Answer

Analysing metadata about network connections (source, destination, port, volume) to detect anomalous traffic patterns without full packet capture

Answer

NetFlow analysis uses metadata about network connections rather than full packet content, providing efficient visibility into traffic patterns, unusual volumes, unexpected destinations, and other anomalies that may indicate threats.

Question 3

What is a 'false positive' in the context of network security monitoring?

Accepted Answer

An alert generated by a security system for an event that is not actually malicious

Answer

A false positive is when a security system incorrectly flags legitimate activity as malicious. High false positive rates waste analyst time and contribute to alert fatigue, potentially causing real threats to be overlooked.

Question 4

What is the purpose of packet capture (PCAP) in network security investigations?

Accepted Answer

To capture and record the full content of network packets for detailed forensic analysis of security incidents

Answer

Packet capture records the full content of network traffic, providing the most detailed possible evidence for forensic investigations. PCAP data can reveal exactly what data was transmitted, which protocols were used, and what commands were sent by attackers.

Question 5

What is 'east-west traffic' monitoring and why is it important in enterprise networks?

Accepted Answer

Monitoring traffic moving laterally between systems within the internal network, which is where attackers move after gaining initial access

Answer

East-west traffic refers to lateral traffic between internal systems within a network. After initial compromise, attackers typically move east-west between internal systems. Monitoring this traffic is critical for detecting lateral movement.

CSOC Practice Test

CSOC Practice Test

CSOC Network Security Monitoring 2