Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CCNA SECFND 210-250 > Ch13-Describing Security Data Collection > Flashcards

Ch13-Describing Security Data Collection Flashcards

1
Q

A key step in implementing a successful SOC

A

to follow a threat-centric approach in network security monitoring.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a threat-centric approach?

A

A threat-centric approach is all about the threat (not just compliance), and the threat’s life cycle, which includes before, during, and after attack phases.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is one result of placing an IPS on the untrusted (outside) segment of a firewall?

A

The IPS can detect new forms of attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Placement of an IPS

A

Optimal placement of an IPS depends on the needs and topology of the network to be protected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Data-Type documents all the individual network sessions based on the session’s 5-tuple

A

Session Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

session’s 5-tuple

A

transport protocol, source IP address, source port, destination IP address, and destination port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

commonly implemented example of session data

A

NetFlow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Analogous to Wiretap

A

Full Packet Capture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

The actual content of a conversation may be extracted from full packet captures.

A

Full Packet Capture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Downside of Full Packet Capture

A

It has tremendous storage requirements, tedious to analyze

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Commonly used file format of Full Packet Capture

A

PCAP(packet capture)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

highlights operations that occur as a result of network sessions and system activities

A

Transaction Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Objects that are mined from network traffic

A

Extracted Content

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

other security monitoring data types that aids in describing network activities at a higher level

A

Statistical Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

These data formulate baselines. Baselines document the aggregate normal patterns and their trend

A

Statistical Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Comparing actual traffic patterns to the baseline patterns can reveal_______

A

anomalous behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

most crystallized of the data types

A

Alert Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Potential Issues with Alert data

A

False positive and false negatives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Advantage of alert data

A

that the tool can process tremendous amounts of network traffic in real time. It is much faster than a human analyst could ever be

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

real-time access to the logs of their devices

A

Syslog

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Code 0

A

Emergency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Code 1

A

Alert

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Code 2

A

Critical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Code 3

A

Error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Code 4

A

Warning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Code 5

A

Notice

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Code 6

A

Informational

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Code 7

A

Debug

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

data point that is extracted from security data that can be used as a high fidelity predictor of system compromise

A

Indicator of Compromise (IOC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

extensible XML schema that enables security professionals to describe the technical characteristics that identify a known threat, an attacker’s methodology, or other evidence of compromise.

A

OpenIOC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

NTP Port

A

UDP port 123

32
Q

protocol that is designed to synchronize the clocks of computers and network devices over a network

A

NTP

33
Q

Which of the following network security data types requires the largest amount of storage?

A

full packet capture

34
Q

Which two statements best describe why it is important to deploy an NTP solution in a network infrastructure?

A

Accurate time stamping across the network is critical to forensic investigation after a compromise occurs.
NTP can provide an authenticated time source from which security tools can operate.

35
Q

IPS is correlated to what other log files?

A

firewall logs, DNS logs, web security logs, email logs, AAA server logs, applications logs, NetFlow records, and PCAPs traffic analysis.

36
Q

open source intrusion prevention system that is offered by the Talos Intelligence Group

A

SNORT

37
Q

A security control acted when malicious activity did not take place.

A

False positive

38
Q

A security control did not act when malicious activity took place.

A

False negative

39
Q

A security control acted when malicious activity took place.

A

True positive

40
Q

A security control did not act, because there was no malicious activity.

A

True negative

41
Q

The security control, such as an IPS or IDS sensor, acted as a consequence of malicious activity, which represents normal and optimal operation.

A

True positives

42
Q

The security control that is acted as a consequence of non-malicious activity, which represents an error, generally caused by too tight proactive controls (which do not permit all legitimate traffic) or too relaxed reactive controls (with too broad descriptions of the attack).

A

False positives

43
Q

The security control has not acted, because there was no malicious activity, which represents normal and optimal operation.

A

True negatives

44
Q

The security control has not acted, even though there was malicious activity, which represents an error, generally caused by too relaxed proactive controls (which permit more than just minimal legitimate traffic) or too specific reactive controls (with too-specific descriptions of the attack).

A

False negatives

45
Q

are generally tuned to be less sensitive in order not to block legitimate traffic, (for example, IPS sensors)

A

Preventive controls

46
Q

are tuned to be more sensitive at a cost of false positives (for example, IDS sensors)

A

detective controls

47
Q

To effectively perform this step of the process, analysts must have the following:

A

An accurate assessment of the time constraints that they must work within

Familiarity with the network being protected to prioritize critical alert

48
Q

You are investigating IPS alerts and finding that many of them have been generated by normal network activity. What is most likely to be the cause of this situation?

A

Proactive controls are too restrictive.

49
Q

Which two security control decisions indicate optimal security control behavior?

A

true positive

true negative

50
Q

What are the two primary purposes of the intrusion analysis process?

A

blocking attacks,identifying attacks

51
Q

Which two statements are true about firewall logs?

A

Firewall logs can help a security analyst understand communication relationships and timing of the attacks.
A small subset of firewall logs usually provides the most benefit to an analyst.

52
Q

DNS logging can capture URL resolution requests and responses. How can these two assist with identifying or reconstructing a compromise or incident?

A

The DNS queries will identify the external server that was being accessed for the incident transactions.,
The DNS name may exhibit exfiltrated data as the subdomain.

53
Q

Status Code: Successful Transactions

A

Begins with 2
200

OK

201

Created

202

Accepted

54
Q

Status Code: Redirected Transactions

A

Begins with 3

301

Moved permanently

302

Moved temporarily

304

Not modified

55
Q

Status Code Client-Side Errors

A

Begins with 4
400

Bad request

401

Unauthorized

403

Forbidden

404

Not found

56
Q

Status Code Server-Side Error

A

Begins with 5
500

Internal server error

501

Not implemented

502

Bad gateway

503

Service unavailable

57
Q

Common HTTP Request Methods

A

GET

Retrieval and simple searches

POST

Submit data-query

PUT

Upload data-files

58
Q

Uncommon, Potentially Malicious Requests

A

HEAD

Metadata retrieval

DELETE

Remove resource

TRACE

Application layer trace of route

OPTIONS

Request available methods

CONNECT

Tunnel SSL connection

PROPFIND

Retrieve properties of an objec

59
Q

What is the purpose of a DLP policy?

A

to prevent end users from sending sensitive or critical information outside the corporate network

60
Q

Which two types of logs can you see on most typical email proxies?

A

logs regarding incoming spam emails

logs regarding incoming emails containing viruses

61
Q

Which two of the following statements best describe the ways in which AAA server logs can be useful in protecting the network and users?

A

Most AAA servers log authentication failures, an excessive number of which may point the security analyst to a brute force attack.

Authentication logs track the success and failure of legitimate users with a time stamp record.

62
Q

What is NGFW?

A

Next Generation Fire Wall

63
Q

What are the additional features of a firewall?

A

raditional firewall services plus VPN, IPS, AMP, DNS inspection, application visibility and control, reputation-based filtering, URL filtering, SSL decryption,

64
Q

Which three are true about the Cisco FirePower NGFW logging?

A

can log packet-level information about IPS events
can identify indications of compromise
can log the NGFW connections events

65
Q

On a Linux system, where are application logs usually stored?

A

/var/log folder

66
Q

Which two statements are true about application logs?

A

The application log file contains events that are logged by the network applications.
Application logs can be used along with the network usage logs to verify that network resources are being used appropriately.

67
Q

Packet Capture Analyst Goals

A

Identify Affected Hosts
After Data is collected
Reconstruct Attack
Analyze Traffic Path

68
Q

It provide the capability to automatically capture the traffic associated with the IPS alerts.

A

Many IPSs, such as Snort,

69
Q

When attempting to reconstruct an incident from a packet capture, which three things should an analyst pay special attention to?

A

IP addresses of hosts that may have been affected

the path that was used in the attack

the timeline of the attack

70
Q

Which statement is true about NetFlow

A

NetFlow provides a complete audit trail of all network communications.

71
Q

What are three pieces of information that NetFlow captures?

A

the time of IP conversations

the amount of data that are transferred during IP conversations

identities of systems that are involved in IP conversations

72
Q

Which three of the following statements are true about network behavior anomaly detection?

A

It can enable an analyst to quickly track down malicious activities on the network by identifying abnormal network traffic conditions.

It works by comparing a known state of normal traffic to current traffic flows.

Its validity and usefulness can be impaired if the size of the sliding window is not set appropriately

73
Q

Which three statements are true about company data and data loss

A

Disgruntled employees are often sources of data leakage.

Company data is at a serious security risk today because data is more available and accessible than ever before.

One of the quickest ways to determine whether internal users may be involved in data loss is by viewing any alarms that the users have triggered.

74
Q

What SIEM means?

A

Security Information and Event Management Systems

75
Q

Which three of the following best describe how a SIEM should be used

A

anomaly detection
data correlation
automated reporting

CCNA SECFND 210-250 (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions