12C - Data Sources (Application and Endpoint logs)

Question 1

What is an endpoint log?

Answer 1

An endpoint log refers to events monitored by security software running on the host rather than by the OS itself.

Question 2

What types of security software can generate endpoint logs?

Answer 2

• Host-based firewalls
• Intrusion detection systems
• Vulnerability scanners
• Antivirus/antimalware protection suites

Question 3

What is an endpoint protection platform (EPP)?

Answer 3

A product that integrates functions like firewalls, intrusion detection, and antivirus into a single solution.

Question 4

What does EDR stand for?

Answer 4

Endpoint Detection and Response

Question 5

What does XDR stand for?

Answer 5

Extended Detection and Response

Question 6

How can endpoint security tools be integrated with SIEM?

Answer 6

Using agent-based software.

Question 7

True or False: Endpoint logs are only monitored by the operating system.

Answer 7

False

Question 8

Fill in the blank: Suites that integrate various security functions are often referred to as an _______.

Answer 8

endpoint protection platform (EPP)