PBQ (SIEM)

Question 1

Virus Signature alert on a desktop for a file named setup.exe

Answer 1

Antimalware
Antimalware software generates an alert when it detects a virus signature on a host system

Question 2

Various nmap actions detected across multiple subnets

Answer 2

NIDS/NIPS
NID/NIPS generate alerts after detecting an automated port scan

Question 3

Entry in the Windows Event Viewer indicate a log-on with new credential that was allocated special privileges

Answer 3

System Logs
System Logs refer to entries in the windows event log that a sysadmin can leverage to provide information about the operating system and various applications

Question 4

Employee testimony indicates that they may have witnessed a breach in progress

Answer 4

Internal Personnel
Employees can provide feedback on breach timelines with information about anything they may have seen or witnessed that was out of the ordinary

Question 5

Increased traffic across the network points to an attempted denial of service (DOS) attack

Answer 5

Network Flow Analyzers
Network analyzers provide high-level visibility into the volumes of traffic and protocols in use in the environment

Question 6

Cryptographic hash of an important file no longer matches its known, accepted value

Answer 6

HIDS/HIPS
HIDS/HIPS can analyze has information of sensitive files to ensure file integrity. when a file is modified , the hash changes. This triggers an alert form HIDS/HIPS

Question 7

An entry in the firewall log indicates a dropped connection intended for a blocked port

Answer 7

Network Device Logs
Various network devices or appliances have multiple logs and reports that can alert on any actions taken inside the network

Question 8

Third-party research indicates a new threat that could be targeting your organization

Answer 8

CTI
Cyber threat intelligence (CTI) is an area of cybersecurity that focuses on collecting and analyzing information about current and potential attacks that threaten an organization’s or its asset safety

Question 9

What process aggregates and analyzes this data to investigate security incidents

Answer 9

SIEM
A Security Information and Event Management (SIEM) tool collects and analyzes log data and provides a single viewpoint for logs collected from many sources