Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Alerting and Monitoring > Alerting and Monitoring > Flashcards

Alerting and Monitoring Flashcards

(62 cards)

Start Studying
1
Q

What is the importance of alerting and monitoring?

A

Crucial for maintaining integrity, confidentiality, and availability of information systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two main components of alerting and monitoring?

A
  • Alerting
  • Monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a True Positive in alerting?

A

Correctly identifies a legitimate issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a False Positive in alerting?

A

Incorrectly indicates an issue when there isn’t one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a True Negative in alerting?

A

Correctly recognizes the absence of an issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a False Negative in alerting?

A

Fails to alert about a real issue

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the goals of an alerting system?

A
  • Maximize true positives
  • Minimize false positives to avoid alert fatigue
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the types of monitoring?

A
  • Automated Monitoring
  • Manual Monitoring
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is log aggregation?

A

Collecting and centralizing log data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of alerting?

A

Notification of potential security incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does scanning involve in monitoring?

A

Continuous examination for anomalies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the purpose of reporting in monitoring?

A

Generating reports on system and network status

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is archiving in the context of monitoring?

A

Storing historical data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is SNMP and its primary use?

A

Widely used in network management systems to monitor and manage network devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the function of a Security Information and Event Management (SIEM) system?

A

Integrated management technologies for holistic security views

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does SIEM collect and aggregate?

A

Log data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the Security Content Automation Protocol (SCAP)?

A

Enables automated vulnerability management, measurement, and policy compliance evaluation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are network traffic flows?

A

A sequence of packets from source to destination identifiable by a unique set of identifiers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does a ‘Single Pane of Glass’ refer to?

A

Consolidates data from different sources into a unified display

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a baseline in monitoring?

A

A reference point representing normal system behavior under typical operating conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does application monitoring focus on?

A

Managing and monitoring software application performance and availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What tools are used for application monitoring?

A
  • New Relic
  • AppDynamics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does infrastructure monitoring observe?

A

Physical and virtual infrastructure, including servers and networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What types of scanning are included in alerting and monitoring activities?

A
  • Vulnerability scanning
  • Configuration scanning
  • Code scanning
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What are the data sources for SIEM?
* Antivirus * DLP systems * NIDS * NIPS * Firewalls * Vulnerability scanners
26
What is the function of alert response and remediation/validation?
Managing and resolving identified issues based on alerts or scans
27
What does alert tuning involve?
Adjusts alert parameters to reduce errors and improve alert relevance
28
What does SNMP stand for?
Simple Network Management Protocol
29
What is the role of an SNMP manager?
Collects and processes information from managed devices
30
What are the types of SNMP messages?
* SET * GET * TRAP
31
What is the purpose of the Management Information Base (MIB)?
A hierarchical namespace containing OIDs and their descriptions
32
What security enhancements does SNMP version 3 offer?
* Integrity * Authentication * Confidentiality
33
What is the primary function of a SIEM?
Real-time or near-real-time analysis of security alerts generated by network hardware and applications
34
What are common SIEM solutions?
* Splunk * ELK (Elastic Stack) * ArcSight * QRadar
35
What does a firewall do?
Acts as a barrier between trusted internal networks and untrusted external networks
36
What is the purpose of vulnerability scanners?
Identify security weaknesses, including missing patches and incorrect configurations
37
What does SCAP stand for?
Security Content Automation Protocol
38
Fill in the blank: The SCAP suite includes the OVAL, XCCDF, and _______.
ARF
39
What is OVAL?
Open Vulnerability and Assessment Language, an XML schema for describing system security states and querying vulnerability reports ## Footnote OVAL helps in automating vulnerability assessment.
40
What does XCCDF stand for?
Extensible Configuration Checklist Description Format, an XML schema for developing and auditing best-practice configuration checklists and rules ## Footnote XCCDF allows improved automation in compliance assessments.
41
What is ARF?
Asset Reporting Format, an XML schema for expressing information about assets and their relationships ## Footnote ARF is vendor and technology neutral and flexible for various reporting applications.
42
What is the purpose of CCE?
Common Configuration Enumeration, a scheme for provisioning secure configuration checks across multiple sources ## Footnote CCE provides unique identifiers for different system configuration issues.
43
What does CPE stand for?
Common Platform Enumeration, which identifies hardware devices, operating systems, and applications ## Footnote Standard format: cpe:/part:vendor:product:version:update:edition:language.
44
What is CVE?
Common Vulnerabilities and Exposures, describes publicly known vulnerabilities with unique identifiers ## Footnote Standard format: CVE-Year first documented-Number (e.g., CVE-2017-0144).
45
What is CVSS used for?
Common Vulnerability Scoring System, provides a numerical score reflecting the severity of a vulnerability (0 to 10) ## Footnote Scores categorize vulnerabilities as none, low, medium, high, or critical.
46
What are SCAP Benchmarks?
Sets of security configuration rules for specific products to establish security baselines ## Footnote They provide detailed checklists for securing systems and are expressed in the XCCDF format.
47
Name two examples of SCAP Benchmarks.
* Red Hat Enterprise Linux Benchmark * CIS Microsoft Windows 10 Enterprise Benchmark
48
What is Full Packet Capture (FPC)?
Captures entire packets, including headers and payloads
49
What is Flow Analysis?
Focuses on recording metadata and statistics about network traffic, saving storage space ## Footnote It does not include actual content, just metadata.
50
What is a Flow Collector?
Records metadata and statistics about network traffic ## Footnote It collects information about type of traffic, protocol used, and data volume.
51
What does flow analysis provide?
Metadata about data, not the actual content ## Footnote Metadata includes details about traffic types and volumes.
52
What is NetFlow?
Cisco-developed protocol for reporting network flow information ## Footnote Also known as IPFIX (IP Flow Information Export).
53
What data does NetFlow collect?
* Network protocol interface * IP version and type * Source and destination IP addresses * Source and destination ports * Type of service used
54
What is Zeek?
Hybrid tool for network monitoring that logs full packet captures based on interest ## Footnote It normalizes data for easy import into other tools for visualization and analysis.
55
What does MRTG stand for?
Multi Router Traffic Grapher, creates graphs displaying network traffic flows through routers and switches
56
What might traffic spikes indicate?
Anomalies that may require investigation ## Footnote They could reveal issues like malware infection or unauthorized data transfer.
57
What is a Single Pane of Glass (SPOG)?
Central point of access for security teams to monitor, manage, and secure an organization's IT environment
58
What are the benefits of a SPOG?
* Simplifies security operations management * Improves collaboration and communication * Aids compliance with regulatory requirements
59
What is the first step in implementing a SPOG?
Defining Requirements, identifying the information, tools, and systems required for effective security management
60
What is the role of APIs in SPOG implementation?
Used to collect and analyze data from various sources ## Footnote They help integrate data sources like log servers and intrusion detection systems.
61
Fill in the blank: Flow analysis information is stored in a _______.
database
62
True or False: Flow analysis includes the actual content of network traffic.
False

Alerting and Monitoring (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions