Security+
CompTIA Security+ SY0-801 / All lessons / Domain 4.0: Security Operations
4Domain 4.0: Security Operations
Security+ topic 4.4

Monitoring and Alerting

Security teams watch systems, applications and networks for signs of trouble. A SIEM (security information and event management) system collects logs from many sources, correlates events, and raises alerts. Agents on endpoints send data to the SIEM, while NetFlow shows who talked to whom on the network. Alerts are tuned to reduce false positives, and important ones are escalated. Other tools include antivirus, DLP, SNMP traps, vulnerability scanners, and SCAP for checking configurations against benchmarks. Logs should be archived so they are available for investigations.

Monitoring and Alerting vocabulary

  • SIEM: A system that collects and correlates logs from many sources and raises security alerts.
  • Alert tuning: Adjusting rules so alerts catch real problems without too many false positives.
  • NetFlow: Network data that records which systems communicated, when, and how much.
  • SCAP: Security Content Automation Protocol: standards for automatically checking system configurations.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A company wants to collect logs from firewalls, servers and endpoints in one place and correlate them to find attacks. Which of the following should it deploy?

  1. (A) SIEM
  2. (B) UPS
  3. (C) MDM
  4. (D) HSM
Show answer

(A) SIEM A SIEM collects and correlates logs and raises alerts.

2. Analysts are ignoring alerts because hundreds each day are false positives. Which of the following should the team do?

  1. (A) Turn off the SIEM
  2. (B) Tune the alert rules
  3. (C) Delete old logs
  4. (D) Add more alerts
Show answer

(B) Tune the alert rules Tuning reduces noise so real alerts stand out.

3. An analyst wants to see which internal hosts sent large amounts of data to an external IP last night, without full packet contents. Which of the following data is the best source?

  1. (A) NetFlow
  2. (B) Badge logs
  3. (C) A risk register
  4. (D) A change request
Show answer

(A) NetFlow NetFlow records who talked to whom and how much.

4. Which of the following automatically checks system settings against a security benchmark?

  1. (A) SCAP
  2. (B) SLA
  3. (C) MOU
  4. (D) OCSP
Show answer

(A) SCAP SCAP is a set of standards for automated configuration checks.

Open 4.4 in the interactive course