Unit 2 - Module 3

Question 1

What are 3 Common Log Sources?

Answer 1

1) Firewall Logs
2) Network Logs
3) Server Logs

Question 2

A Firewall Log records what kind of traffic and what requests from the internet?

Answer 2

Incoming Traffic and Outbound requests.

Question 3

A network log records what 2 connections?

Answer 3

1) Records all computers and devices connected to the network.
2) Records connections between devices and services.

Question 4

Server Log records what? It also includes what actions?

Answer 4

1) Records websites, emails, or file shares.
2) Records actions such as login, password, and username requests.

Question 5

What does SIEM tool stand for?

Answer 5

Security Information and Event Management

Question 6

What does a SIEM tool do?

Answer 6

Collects and analyzes log data to monitor critical activities.

Question 7

Define SEIM Metrics

Answer 7

Response time, availability, and failure rate which are used to asses the performance of a software application.

Question 8

What is does SOAR stand for?

Answer 8

Security orchestration, automation, and response.

Question 9

What is SOAR made up of and what does it do?

Answer 9

1) Collection of applications, tools, and workflows.
2) Uses automation to respond to security incidents.

Question 10

What are 3 types of SIEM tools?

Answer 10

Self-Hosted
Cloud-hosted
Hybrid

Question 11

1) What is Splunk Enterprise? 2) How is it hosted? 3) What does it do?

Answer 11

1) A SIEM tool
2) Self-hosted
3) Retain, analyze and searches companies log data

Question 12

1) What is Splunk Cloud? 2) How is it hosted? 3) What does it do?

Answer 12

1) A SIEM tool
2) Cloud-hosted
3) Retain, analyze and searches companies log data

Question 13

1) What is Chronicle? 2) How is it hosted? 3) What does it do?

Answer 13

1) A SIEM tool
2) Cloud-native
3) Retain, analyze and searches companies log data

Question 14

What is the Security posture dashboard?

Answer 14

Monitors and investigates potential threats in real time.

( Displays last 24 hours )

Question 15

What is the Executive summary dashboard?

Answer 15

This dashboard analyzes and monitors the overall health of the organization over time

Question 16

1) What is the Incident review dashboard? 2) How can it be helpful after an incident?

Answer 16

1) This dashboard allows analysts to identify suspicious patterns that can occur in the event of an incident.
2) This dashboard can be very helpful because it provides a visual timeline of the events leading up to an incident.

Question 17

What does the Risk Analysis Dashboard help with?

Answer 17

The risk analysis dashboard helps analysts identify risk for each risk object (e.g., a specific user, a computer, or an IP address).

Question 18

What is Enterprise insights dashboard?

Answer 18

This dashboard highlights recent alerts, identifying suspicious domain names in logs, known as indicators of compromise (IOCs).

Question 19

What is Data ingestion and health dashboard?

Answer 19

The data ingestion and health dashboard shows the number of event logs, log sources, and success rates of data being processed into Chronicle.

Question 20

What is IOC matches dashboard?

Answer 20

The IOC matches dashboard indicates the top threats, risks, and vulnerabilities to the organization.

Question 21

What is the Main dashboard?

Answer 21

The main dashboard displays a high-level summary of information related to the organization’s data ingestion, alerting, and event activity over time.

Question 22

What is the Rule detections dashboard?

Answer 22

The rule detections dashboard provides statistics related to incidents with the highest occurrences, severities, and detections over time.