CSOC Network Security Monitoring

Question 1

What is an Intrusion Detection System (IDS) and how does it differ from an Intrusion Prevention System (IPS)?

Accepted Answer

An IDS monitors and alerts on suspicious activity; an IPS actively blocks detected threats in real time

Answer

An IDS blocks threats automatically; an IPS only generates alerts for human review

Answer

An IDS monitors internal network traffic only; an IPS monitors external traffic only

Answer

There is no functional difference — IDS and IPS are different names for the same system

Question 2

What is 'network traffic analysis' (NTA) and how does it support cybersecurity monitoring?

Accepted Answer

Examining network traffic patterns to detect anomalies, malicious activity, and policy violations

Answer

Measuring network bandwidth utilisation to support capacity planning

Answer

Analysing the physical network topology to identify hardware failures

Answer

Monitoring user productivity by tracking websites visited during work hours

Question 3

What is the purpose of a firewall in network security?

Accepted Answer

To filter network traffic based on defined rules, permitting authorised traffic and blocking unauthorised access

Answer

To encrypt all network traffic transmitted between internal and external networks

Answer

To detect and remove malware from files passing through the network

Answer

To authenticate users before granting them access to network resources

Question 4

What does 'log management' involve in network security monitoring?

Accepted Answer

Collecting, storing, and analysing log data from network devices and systems to detect threats and support investigations

Answer

Managing the physical log books maintained at secure server rooms

Answer

Configuring network devices to disable unnecessary logging to reduce storage costs

Answer

Reviewing logs only after a security incident has been confirmed

Question 5

What is a 'honeypot' in network security?

Accepted Answer

A decoy system designed to attract attackers and observe their tactics, techniques, and procedures

Answer

A secure storage vault for sensitive cryptographic keys

Answer

A network segment containing systems with the highest security controls

Answer

A software tool that automatically patches vulnerable systems in the network

Question 6

What is 'baseline monitoring' in network security operations?

Accepted Answer

Establishing what normal network behaviour looks like and alerting on deviations that may indicate a security incident

Answer

Setting minimum security standards that all network devices must meet

Answer

Monitoring networks to ensure they meet minimum performance thresholds

Answer

Conducting an initial security assessment before deploying a new network