Security Monitoring -- Quiz

Question 1 of 6

A security analyst reviews authentication logs from the VPN gateway and notices 300 failed login attempts from 12 different IP addresses over 45 minutes, followed by a successful login. Each individual server's log shows fewer than 30 failed attempts from any single IP — below the per-source alert threshold. Which monitoring capability would have detected this as an attack?

Firewall rules blocking the source IPs after the first failed attempt SIEM correlation across all authentication logs, linking the distributed low-volume attempts into a recognizable brute-force pattern Continuous scanning identifying that the user's workstation had outdated software Email notification sent to the user when their account was accessed from a new device

Question 2 of 6

According to the IBM Security 2022 report cited in the Security+ curriculum, what is the average time for an organization to identify and contain a data breach, and what does this imply for log retention policy?

30 days; organizations should retain logs for at least 60 days to cover the discovery window 6 weeks; a 90-day retention policy provides adequate coverage for most breach scenarios Approximately 9 months; logs must be retained for at least this period for historical forensic evidence to remain available when a breach is eventually discovered 2 years; all security logs must be retained indefinitely under federal law

Question 3 of 6

A security team deploys a new SIEM with default alert rules and immediately begins receiving 3,000 alerts per day. Analysts start acknowledging alerts without investigation because volume is unmanageable. Two weeks later, a real attack indicator is dismissed as another probable false positive. What process should have been performed before activating high-volume alert rules?

Installing a second SIEM to share the alert processing load between two systems Alert tuning — calibrating thresholds and rules against the organization's actual baseline before enabling high-volume alerting in production Reducing the scope of monitoring to only the most critical systems to lower alert volume Hiring additional analysts to match the 3,000-alert daily volume with sufficient investigative capacity

Question 4 of 6

A database server that normally transfers 3–6 GB of data per day is detected transferring 85 GB to an external IP address in a 2-hour window on a Friday evening. The SIEM fires a High alert. What type of security event does this pattern most likely indicate, and what should be the immediate response?

A scheduled large backup — verify with the backup team before taking any action Data exfiltration; quarantine the server immediately to stop the transfer and prevent further compromise, then investigate A DDoS attack against the server; block all inbound connections and contact the ISP Normal end-of-week data processing; the baseline alert threshold is likely set too low and should be raised

Question 5 of 6

A security analyst needs to quickly determine how many systems in the environment are running a specific version of a web framework that was just disclosed as critically vulnerable. Which monitoring capability makes this query answerable within minutes?

Manual review of each system's configuration by individual server administrators Initiating a new vulnerability scan across all systems and waiting for results in 24–48 hours Querying the continuously-updated scan database that already contains installed application versions for all network-connected devices Contacting the software vendor to obtain a list of registered installations within the organization

Question 6 of 6

An organization retains security logs for 90 days. A breach is discovered in November and forensic investigation determines the attacker first gained access in February — nine months earlier. Investigators request the February through August logs to reconstruct lateral movement and identify the initial compromise vector. What is the likely outcome?

The logs are available because the SIEM automatically retains all data indefinitely by default The logs were automatically backed up to cold storage and can be retrieved within 48 hours The investigation cannot proceed for the period before the 90-day window; the initial compromise vector, lateral movement, and full scope of the breach cannot be reconstructed from missing logs The investigation can rely on endpoint memory and running process data to reconstruct the nine-month history without logs

Matching

Match each description to the correct security monitoring concept.

1. Centralizes logs from firewalls, servers, VPN concentrators, and cloud services into one database for correlation and reporting

2. Isolates a compromised system from network communication to stop lateral spread while preserving the system for forensic analysis

3. The ongoing process of calibrating alert thresholds to reduce false positives and false negatives as the organization's baseline understanding improves

4. Retaining security log data over an extended period to support forensic investigation, compliance audits, and legal proceedings

1. 2. 3. 4.

A. SIEM

B. Quarantine

C. Alert tuning

D. Archiving

Security Monitoring — Quiz

Matching