Section 23.219 Alerting and Monitoring: & Monitoring Resources

Question 1

Importance

Alerting and Monitoring

Answer 1

Crucial for maintaining integrity, confidentiality, and availability of
information systems

Components:

● Alerting (notifying personnel of potential security incidents)

● Monitoring (continuous observation to detect anomalies or threats)

Question 2

Types of Alerts

True Positive

Answer 2

Correctly identifies a legitimate issue

Question 3

False Positive

Answer 3

Incorrectly indicates an issue when there isn’t one

Question 4

True Negative

Answer 4

Correctly recognises the absence of an issue

Question 5

False Negative

Answer 5

Fails to alert about a real issue

Question 6

Alerting System Goals

Answer 6

● Maximise true positives

● Minimise false positives to avoid alert fatigue

Question 7

Monitoring Types

Answer 7

Automated Monitoring
○ Software tools for scanning and analysing

Manual Monitoring
○ Human personnel actively reviewing and analyzing

Question 8

Monitoring Resources

Monitoring Systems

Answer 8

Involves observing a computer system’s performance, including…

● CPU
● Memory
● Disk usage
● Network performance

Question 9

Baseline

Answer 9

A reference point representing normal system behavior under typical operating conditions

■ Baseline metrics can include CPU usage, memory utilisation, disk activity, and network traffic

■ Deviations from the baseline can indicate potential issues, prompting proactive troubleshooting and maintenance

Baseline reference point

Question 10

Application Monitoring

Answer 10

Focuses on managing and monitoring software application performance and availability

■ Tracks errors, bottlenecks, and issues that may affect an application’s performance or user experience

■ Tools like New Relic and AppDynamics track response times and error rates

■ Slower response times may indicate code problems or resource deficiencies

Question 11

Infrastructure Monitoring

Answer 11

Observes physical and virtual infrastructure, including servers, networks, virtual machines, containers, and cloud services

■ Provides insights into network traffic, bandwidth usage, and device status

■ Tools like SolarWinds and PRTG Network Monitor help monitor network infrastructure

■ Overloaded network switches can signal the need for additional capacity or configuration issues