1.7

Question 1

Collecting and analyzing multiple sources of intelligence data to gain a comprehensive understanding of potential security threats

Answer 1

Intelligence fusion

Question 2

Real-time data streams containing information about known and emerging security threats, collected from various sources

Answer 2

Threat feeds

Question 3

Updates and guidance on how to address security threats, provided by security vendors, government agencies, or open-source intelligence

Answer 3

Advisories and bulletins

Question 4

Adapting the hunt for potential threats and vulnerabilities based on new information

Answer 4

Maneuver

Question 5

When a vulnerability scanner flags something as a vulnerability, but it is not actually a threat

Answer 5

False positives

Question 6

When a vulnerability is present, but the scanner fails to identify it

Answer 6

False negatives

Question 7

Analyzing logs generated by systems and applications to detect and respond to security incidents

Answer 7

Log reviews

Question 8

Credentialed vs. non-credentialed scans

Answer 8

Scanning with administrative credentials or without them. A credentialed scan provides more in-depth information on potential vulnerabilities

Question 9

Intrusive vs. non-intrusive scans

Answer 9

Scanning that either simulates an attack or doesn’t

Question 10

Scanning applications for vulnerabilities

Answer 10

Application scans

Question 11

Scanning web applications for vulnerabilities

Answer 11

Web application scans

Question 12

Scanning networks for vulnerabilities

Answer 12

Network scans

Question 13

Standards for identifying, prioritizing, and reporting vulnerabilities

Answer 13

Common Vulnerabilities and Exposures (CVE)/Common Vulnerability Scoring System (CVSS)

Question 14

Reviewing the configuration of systems and applications to identify potential vulnerabilities

Answer 14

Configuration review

Question 15

Collecting and analyzing security-related data from multiple sources to detect and respond to security incidents.

Answer 15

Syslog/Security information and event management (SIEM)

Question 16

Analyzing reports generated by security tools and systems to identify potential vulnerabilities and security incidents.

Answer 16

Review reports

Question 17

Capturing and analyzing network traffic to identify potential security incidents.

Answer 17

Packet capture

Question 18

Using data from multiple sources to identify potential vulnerabilities and security incidents.

Answer 18

Data inputs

Question 19

Analyzing user behavior to detect anomalies and potential security incidents.

Answer 19

User behavior analysis

Question 20

Analyzing online conversations and social media to identify potential security incidents.

Answer 20

Sentiment analysis

Question 21

Monitoring systems and networks for potential security incidents.

Answer 21

Security monitoring

Question 22

Collecting and aggregating logs from multiple sources to identify potential security incidents.

Answer 22

Log aggregation