CyberVista Security Operations and Monitoring Questions and Answers — Questions and Answers
Question 1: A Security Operations Center (SOC) analyst is overwhelmed with a high volume of alerts from various security tools. To improve efficiency and reduce response times, management decides to implement a solution that can aggregate data from different systems and automate response actions based on predefined playbooks. Which of the following technologies BEST describes this solution?
- Security Information and Event Management (SIEM)
- Security Orchestration, Automation, and Response (SOAR) (Correct answer)
- Intrusion Detection System (IDS)
- Vulnerability Scanner
Correct answer: Security Orchestration, Automation, and Response (SOAR)
A SOAR (Security Orchestration, Automation, and Response) platform is designed to address this exact scenario. It integrates with various security tools to automate and orchestrate incident response workflows using playbooks, which significantly reduces manual effort and speeds up response times. While a SIEM collects and analyzes logs, it doesn't primarily focus on automated response actions.
Question 2: According to the NIST Special Publication 800-61, which phase of the incident response lifecycle involves learning from a security incident and implementing improvements to prevent its recurrence?
- Containment, Eradication, & Recovery
- Detection & Analysis
- Preparation
- Post-Incident Activity (Correct answer)
Correct answer: Post-Incident Activity
The Post-Incident Activity phase is the final stage in the NIST incident response lifecycle. This phase includes a 'lessons learned' meeting and analysis to understand the incident's root cause and improve security controls, policies, and procedures to prevent future similar incidents.
Question 3: A cybersecurity analyst receives a threat intelligence report detailing the specific Tactics, Techniques, and Procedures (TTPs) used by a newly identified advanced persistent threat (APT) group that targets financial institutions. What type of threat intelligence is this?
- Strategic
- Technical
- Tactical
- Operational (Correct answer)
Correct answer: Operational
Operational threat intelligence provides insights into the 'how' and 'where' of an attack, focusing on the TTPs, motives, and campaign plans of specific threat actors. This information helps security teams understand the nature of attacks and anticipate future actions. Tactical intelligence is more focused on immediate indicators like malicious IPs or hashes.
Question 4: During a routine security audit, a vulnerability scanner identifies a critical cross-site scripting (XSS) flaw in a public-facing web application. Which of the following tools would be MOST appropriate for this type of discovery?
- Network Mapper (e.g., Nmap)
- Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP) (Correct answer)
- Container Scanner (e.g., Trivy)
- Static Application Security Testing (SAST) tool
Correct answer: Web Application Vulnerability Scanner (e.g., Acunetix, OWASP ZAP)
Web application vulnerability scanners are specialized tools designed to scan and identify security flaws specific to web applications, such as SQL injection and cross-site scripting (XSS). While a SAST tool also finds vulnerabilities, it does so by analyzing source code, not by testing the running application from the outside.
Question 5: A SOC team is configuring its logging and monitoring strategy. Which of the following is a primary goal of continuous monitoring in a security operations context?
- To perform a one-time, comprehensive security audit of all systems.
- To maintain ongoing awareness of the organization's security posture and risks. (Correct answer)
- To replace the need for an incident response plan.
- To exclusively track the performance and uptime of network hardware.
Correct answer: To maintain ongoing awareness of the organization's security posture and risks.
Continuous monitoring is the process of maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. It is a proactive and iterative process, not a one-time audit, and it complements, rather than replaces, incident response planning.
Question 6: An organization has successfully contained a malware outbreak by isolating the affected systems from the network. According to the NIST incident response lifecycle, what is the immediate NEXT step the security team should take?
- Preparation
- Post-Incident Activity
- Eradication (Correct answer)
- Detection & Analysis
Correct answer: Eradication
The NIST incident response lifecycle groups Containment, Eradication, and Recovery together as a single phase. After an incident is successfully contained to prevent further spread, the next logical step is Eradication—the process of removing the threat, such as malware or a malicious actor's foothold, from the affected systems.
CyberVista Security Operations and Monitoring Questions and Answers
A Security Operations Center (SOC) analyst is overwhelmed with a high volume of alerts from various security tools.
To improve efficiency and reduce response times, management decides to implement a solution that can aggregate data from different systems and automate response actions based on predefined playbooks.
Which of the following technologies BEST describes this solution?