CSOC Network Security Monitoring — Questions and Answers
Question 1: What is an Intrusion Detection System (IDS) and how does it differ from an Intrusion Prevention System (IPS)?
- An IDS monitors and alerts on suspicious activity; an IPS actively blocks detected threats in real time (Correct answer)
- An IDS blocks threats automatically; an IPS only generates alerts for human review
- An IDS monitors internal network traffic only; an IPS monitors external traffic only
- There is no functional difference — IDS and IPS are different names for the same system
Correct answer: An IDS monitors and alerts on suspicious activity; an IPS actively blocks detected threats in real time
An IDS passively monitors network traffic and generates alerts when suspicious patterns are detected, requiring human action. An IPS goes further by actively blocking or dropping malicious traffic in real time without waiting for human intervention.
Question 2: What is 'network traffic analysis' (NTA) and how does it support cybersecurity monitoring?
- Examining network traffic patterns to detect anomalies, malicious activity, and policy violations (Correct answer)
- Measuring network bandwidth utilisation to support capacity planning
- Analysing the physical network topology to identify hardware failures
- Monitoring user productivity by tracking websites visited during work hours
Correct answer: Examining network traffic patterns to detect anomalies, malicious activity, and policy violations
NTA involves capturing and analysing network packets and flow data to identify anomalous behaviour, detect known attack patterns, and uncover suspicious communications such as command-and-control traffic or data exfiltration.
Question 3: What is the purpose of a firewall in network security?
- To filter network traffic based on defined rules, permitting authorised traffic and blocking unauthorised access (Correct answer)
- To encrypt all network traffic transmitted between internal and external networks
- To detect and remove malware from files passing through the network
- To authenticate users before granting them access to network resources
Correct answer: To filter network traffic based on defined rules, permitting authorised traffic and blocking unauthorised access
A firewall acts as a traffic filter at network boundaries, applying rules to permit or deny traffic based on criteria such as IP addresses, ports, and protocols. It enforces access control between network segments.
Question 4: What does 'log management' involve in network security monitoring?
- Collecting, storing, and analysing log data from network devices and systems to detect threats and support investigations (Correct answer)
- Managing the physical log books maintained at secure server rooms
- Configuring network devices to disable unnecessary logging to reduce storage costs
- Reviewing logs only after a security incident has been confirmed
Correct answer: Collecting, storing, and analysing log data from network devices and systems to detect threats and support investigations
Log management involves the systematic collection of log data from devices, applications, and systems, storing it securely, and analysing it to detect threats, support forensic investigations, and meet compliance requirements.
Question 5: What is a 'honeypot' in network security?
- A decoy system designed to attract attackers and observe their tactics, techniques, and procedures (Correct answer)
- A secure storage vault for sensitive cryptographic keys
- A network segment containing systems with the highest security controls
- A software tool that automatically patches vulnerable systems in the network
Correct answer: A decoy system designed to attract attackers and observe their tactics, techniques, and procedures
A honeypot is a deliberately vulnerable decoy system placed in a network to attract attackers. It provides intelligence on attack methods and TTPs while diverting attackers away from real systems and generating alerts when accessed.
Question 6: What is 'baseline monitoring' in network security operations?
- Establishing what normal network behaviour looks like and alerting on deviations that may indicate a security incident (Correct answer)
- Setting minimum security standards that all network devices must meet
- Monitoring networks to ensure they meet minimum performance thresholds
- Conducting an initial security assessment before deploying a new network
Correct answer: Establishing what normal network behaviour looks like and alerting on deviations that may indicate a security incident
Baseline monitoring involves first establishing what normal traffic patterns, user behaviour, and system activity look like, then continuously monitoring for deviations from that baseline that may indicate an attack or compromise.
CSOC Network Security Monitoring
What is an Intrusion Detection System (IDS) and how does it differ from an Intrusion Prevention System (IPS)?