Network Security Monitoring Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Network Security Monitoring flashcards as text
What is DNS monitoring and why is it important for network security?
Answer: Monitoring DNS queries and responses to detect malicious domains, DNS tunnelling, and command-and-control communications
DNS monitoring is a valuable security technique because attackers frequently use DNS for command-and-control communications, data exfiltration via DNS tunnelling, and accessing malicious domains. Monitoring DNS traffic can reveal these threats.
What is NetFlow analysis and how is it used in network security monitoring?
Answer: Analysing metadata about network connections (source, destination, port, volume) to detect anomalous traffic patterns without full packet capture
NetFlow analysis uses metadata about network connections rather than full packet content, providing efficient visibility into traffic patterns, unusual volumes, unexpected destinations, and other anomalies that may indicate threats.
What is a 'false positive' in the context of network security monitoring?
Answer: An alert generated by a security system for an event that is not actually malicious
A false positive is when a security system incorrectly flags legitimate activity as malicious. High false positive rates waste analyst time and contribute to alert fatigue, potentially causing real threats to be overlooked.
What is the purpose of packet capture (PCAP) in network security investigations?
Answer: To capture and record the full content of network packets for detailed forensic analysis of security incidents
Packet capture records the full content of network traffic, providing the most detailed possible evidence for forensic investigations. PCAP data can reveal exactly what data was transmitted, which protocols were used, and what commands were sent by attackers.
What is 'east-west traffic' monitoring and why is it important in enterprise networks?
Answer: Monitoring traffic moving laterally between systems within the internal network, which is where attackers move after gaining initial access
East-west traffic refers to lateral traffic between internal systems within a network. After initial compromise, attackers typically move east-west between internal systems. Monitoring this traffic is critical for detecting lateral movement.
What is the role of threat intelligence feeds in a CSOC's network monitoring activities?
Answer: They provide up-to-date information on known malicious IPs, domains, and attack signatures that can be used to improve detection rules
Threat intelligence feeds provide curated, up-to-date information about known threat actors, malicious infrastructure, and attack signatures. CSOC analysts use this information to enrich their monitoring rules, prioritise alerts, and proactively hunt for threats.