chapter 7

Question 1

1. Which technology is a proprietary SIEM system?

SNMP agent
Splunk
Stealthwatch
NetFlow collector

Answer 1

Splunk

Security information event management (SIEM) is a technology that is used in enterprise organizations to provide real-time reporting and long-term analysis of security events. Splunk is a proprietary SIEM system.

Question 2

Which term is used to describe legitimate traffic that is mistaken for unauthorized traffic by firewalls and IPSs?

True positive
True negative
False positive
False negative

Answer 2

False positive

Network security devices such as firewalls and intrusion prevention systems (IPSs) use preconfigured rules to identify malicious traffic on the network. Sometimes legitimate traffic is mistakenly identified as unauthorized or malicious. When legitimate traffic is incorrectly identified as unauthorized, it is known as a false positive.

Question 3

Which monitoring technology mirrors traffic flowing through a switch to an analysis device connected to another switch port?
SNMP
SIEM
SPAN 
NetFlow

Answer 3

SPAN

When enabled on a switch, SPAN, or port mirroring, copies frames sent and received by the switch and forwards them to another port, known as a Switch Port Analyzer port, which has an analysis device attached.