CSOC Network Security Monitoring

Question 1

What is an Intrusion Detection System (IDS) and how does it differ from an Intrusion Prevention System (IPS)?

Accepted Answer

An IDS monitors and alerts on suspicious activity; an IPS actively blocks detected threats in real time

Answer

An IDS passively monitors network traffic and generates alerts when suspicious patterns are detected, requiring human action. An IPS goes further by actively blocking or dropping malicious traffic in real time without waiting for human intervention.

Question 2

What is 'network traffic analysis' (NTA) and how does it support cybersecurity monitoring?

Accepted Answer

Examining network traffic patterns to detect anomalies, malicious activity, and policy violations

Answer

NTA involves capturing and analysing network packets and flow data to identify anomalous behaviour, detect known attack patterns, and uncover suspicious communications such as command-and-control traffic or data exfiltration.

Question 3

What is the purpose of a firewall in network security?

Accepted Answer

To filter network traffic based on defined rules, permitting authorised traffic and blocking unauthorised access

Answer

A firewall acts as a traffic filter at network boundaries, applying rules to permit or deny traffic based on criteria such as IP addresses, ports, and protocols. It enforces access control between network segments.

Question 4

What does 'log management' involve in network security monitoring?

Accepted Answer

Collecting, storing, and analysing log data from network devices and systems to detect threats and support investigations

Answer

Log management involves the systematic collection of log data from devices, applications, and systems, storing it securely, and analysing it to detect threats, support forensic investigations, and meet compliance requirements.

Question 5

What is a 'honeypot' in network security?

Accepted Answer

A decoy system designed to attract attackers and observe their tactics, techniques, and procedures

Answer

A honeypot is a deliberately vulnerable decoy system placed in a network to attract attackers. It provides intelligence on attack methods and TTPs while diverting attackers away from real systems and generating alerts when accessed.

CSOC Practice Test

CSOC Practice Test

CSOC Network Security Monitoring