Threat Detection & Monitoring Flashcards

What is the primary purpose of threat detection?

Answer: Identify cybersecurity threats before damage occurs

The primary purpose of threat detection is to proactively identify malicious activities, vulnerabilities, or potential attacks within a system or network before they can cause significant harm. By detecting threats early, organizations can take timely action to prevent security breaches, minimize potential damage, and protect sensitive data and systems from compromise.

Which tool is most commonly used for real-time security monitoring in Microsoft environments?

Answer: Microsoft Sentinel

Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is specifically designed for real-time security monitoring, threat detection, investigation, and response across an enterprise's entire digital estate within Microsoft environments. Its comprehensive capabilities make it the go-to tool for this purpose.

What type of attack does anomaly-based detection primarily identify?

Answer: Zero-day attacks

Anomaly-based detection works by establishing a baseline of normal system behavior and then flagging any deviations from this baseline as potential threats. This method is particularly effective at identifying zero-day attacks, which are previously unknown vulnerabilities or exploits that lack predefined signatures, as they represent unusual and unexpected activity that deviates from the norm.

Which of the following is an example of an Indicator of Compromise (IoC)?

Answer: Unauthorized login attempts

An Indicator of Compromise (IoC) is forensic data, such as data found in system logs or files, that identifies suspicious activity on a network or endpoint and indicates a potential intrusion. Unauthorized login attempts are a clear example of an IoC, signaling that an attacker may be trying to gain access to a system or account, which is a critical sign of a security breach.

What is the main advantage of machine learning in threat detection?

Answer: Detects complex cyber threats through pattern recognition

Machine learning significantly enhances threat detection by enabling systems to analyze vast amounts of data and identify subtle, complex patterns indicative of malicious activity that might be missed by traditional signature-based methods. This capability allows for the detection of novel and evolving cyber threats, including polymorphic malware and advanced persistent threats, through sophisticated pattern recognition.

Which Microsoft security solution provides endpoint threat detection and response?

Answer: Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is a comprehensive, cloud-powered endpoint security solution that provides advanced threat protection, post-breach detection, automated investigation, and response capabilities. It specifically focuses on securing endpoints like workstations and servers against sophisticated cyber threats. This makes it the correct Microsoft solution for endpoint threat detection and response.