Network Security Monitoring Flashcards
6 cards from real CSOC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Network Security Monitoring flashcards as text
What is an Intrusion Detection System (IDS) and how does it differ from an Intrusion Prevention System (IPS)?
Answer: An IDS monitors and alerts on suspicious activity; an IPS actively blocks detected threats in real time
An IDS passively monitors network traffic and generates alerts when suspicious patterns are detected, requiring human action. An IPS goes further by actively blocking or dropping malicious traffic in real time without waiting for human intervention.
What is 'network traffic analysis' (NTA) and how does it support cybersecurity monitoring?
Answer: Examining network traffic patterns to detect anomalies, malicious activity, and policy violations
NTA involves capturing and analysing network packets and flow data to identify anomalous behaviour, detect known attack patterns, and uncover suspicious communications such as command-and-control traffic or data exfiltration.
What is the purpose of a firewall in network security?
Answer: To filter network traffic based on defined rules, permitting authorised traffic and blocking unauthorised access
A firewall acts as a traffic filter at network boundaries, applying rules to permit or deny traffic based on criteria such as IP addresses, ports, and protocols. It enforces access control between network segments.
What does 'log management' involve in network security monitoring?
Answer: Collecting, storing, and analysing log data from network devices and systems to detect threats and support investigations
Log management involves the systematic collection of log data from devices, applications, and systems, storing it securely, and analysing it to detect threats, support forensic investigations, and meet compliance requirements.
What is a 'honeypot' in network security?
Answer: A decoy system designed to attract attackers and observe their tactics, techniques, and procedures
A honeypot is a deliberately vulnerable decoy system placed in a network to attract attackers. It provides intelligence on attack methods and TTPs while diverting attackers away from real systems and generating alerts when accessed.
What is 'baseline monitoring' in network security operations?
Answer: Establishing what normal network behaviour looks like and alerting on deviations that may indicate a security incident
Baseline monitoring involves first establishing what normal traffic patterns, user behaviour, and system activity look like, then continuously monitoring for deviations from that baseline that may indicate an attack or compromise.