CyberVista Security Operations and Monitoring Flashcards

A Security Operations Center (SOC) analyst is overwhelmed with a high volume of alerts from various security tools. To improve efficiency and reduce response times, management decides to implement a solution that can aggregate data from different systems and automate response actions based on predefined playbooks. Which of the following technologies BEST describes this solution?

Answer: Security Orchestration, Automation, and Response (SOAR)

A SOAR (Security Orchestration, Automation, and Response) platform is designed to address this exact scenario. It integrates with various security tools to automate and orchestrate incident response workflows using playbooks, which significantly reduces manual effort and speeds up response times. While a SIEM collects and analyzes logs, it doesn't primarily focus on automated response actions.

According to the NIST Special Publication 800-61, which phase of the incident response lifecycle involves learning from a security incident and implementing improvements to prevent its recurrence?

Answer: Post-Incident Activity

The Post-Incident Activity phase is the final stage in the NIST incident response lifecycle. This phase includes a 'lessons learned' meeting and analysis to understand the incident's root cause and improve security controls, policies, and procedures to prevent future similar incidents.

A cybersecurity analyst receives a threat intelligence report detailing the specific Tactics, Techniques, and Procedures (TTPs) used by a newly identified advanced persistent threat (APT) group that targets financial institutions. What type of threat intelligence is this?

Answer: Operational

Operational threat intelligence provides insights into the 'how' and 'where' of an attack, focusing on the TTPs, motives, and campaign plans of specific threat actors. This information helps security teams understand the nature of attacks and anticipate future actions. Tactical intelligence is more focused on immediate indicators like malicious IPs or hashes.

During a routine security audit, a vulnerability scanner identifies a critical cross-site scripting (XSS) flaw in a public-facing web application. Which of the following tools would be MOST appropriate for this type of discovery?

Answer: Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP)

Web application vulnerability scanners are specialized tools designed to scan and identify security flaws specific to web applications, such as SQL injection and cross-site scripting (XSS). While a SAST tool also finds vulnerabilities, it does so by analyzing source code, not by testing the running application from the outside.

A SOC team is configuring its logging and monitoring strategy. Which of the following is a primary goal of continuous monitoring in a security operations context?

Answer: To maintain ongoing awareness of the organization's security posture and risks.

Continuous monitoring is the process of maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. It is a proactive and iterative process, not a one-time audit, and it complements, rather than replaces, incident response planning.

An organization has successfully contained a malware outbreak by isolating the affected systems from the network. According to the NIST incident response lifecycle, what is the immediate NEXT step the security team should take?

Answer: Eradication

The NIST incident response lifecycle groups Containment, Eradication, and Recovery together as a single phase. After an incident is successfully contained to prevent further spread, the next logical step is Eradication—the process of removing the threat, such as malware or a malicious actor's foothold, from the affected systems.