stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CIT - Module 7: SIEM & SOAR Flashcards | StudBud
Explore
/
CIT - Module 7: SIEM & SOAR
CIT - Module 7: SIEM & SOAR
17 terms
·
StudBud Administration
·
115 plays
Imported from external platform
Flashcards
17 cards
F
Practice quiz
P
Host live
L
Questions
17
Answers
1
What is an Alert?
SIEM status indicating the logs are actively being scanned
Automated message sent to users with flagged behavior
A SIEM message that indicates a log is missing or corrupted
Message indicating a possible anomaly, threat, or attack
2
What are
2
common categories of alerts
Aggrevation
Correlation
Aggregation
Correction
3
Which alert consolidates logs with identical content into predefined fields?
Compound Alerts
Redundancy Alerts
Integration Alerts
Correlation Alerts
4
What is a dashboard in SIEM?
The CLI interface that presents different types of alerts and statistics
A GUI interface that presents different types of alerts and statistics
That thing I hit my head on when my brother slams on the brakes
SIEM wizard that creates multiple alerts, searchs, and analysis at once
5
What is needed to accurately detect suspicious behavior?
One user must be set as a control, which all other behavior is compared to
All actions must be logged. 100% accuracy means 100% data capture
A window of normal activities and behavior to compare it against
A small circuit board must be sacrificed to the Cloud gods
6
Which is NOT a benefit of SOAR?
Saves time and money
Eliminates the need for tier 1 analysts
Alerts automatically inform the SOC whenever an action is executed
Reduces response time to incidents
7
What is a Playbook?
A flow of actions that reduce human interaction in repetitive tasks
A list of possible responses to choose from for specific network conditions
The automatic collection and analysis of system logs
That thing Barney Stinson used to pick up women
8
What is the process of identifying and prioritizing security alerts by severity called?
Triage
Escalation
Levelling
Reaction
9
Which is NOT true about anomaly exploration?
Can only be used to assess past actions, not for real-time detection
Studies environmental trends and looks for deviations from the norm
Detects suspicious behavior
Uses a timeline to study behavior
10
Which
2
are true about how SOAR works? (pick 2)
Automates actions upon detection of specific events
Receives event records from multiple sources
Automates actions upon command
Receives and responds to one event log at a time
11
Which of these are common types of alert? (more than 1)
Compromised user account and/or workstation
Caution
Fraud
Abuse of privileges
12
Why do correlation alerts need to be carefully planned and defined?
They can cause many false positive results
They can be a massive drain on network resources
They cannot be edited once saved
They can cause many false negative results
13
Which alert indicates suspicious behavior by connecting the steps between events?
Chain Alert
Smart Alert
Causation Alert
Correlation Alert
14
What defines SIEM alerts? (Choose 2)
SIEM products have preset alert definitions
NOC
SOC
Machine Learning
15
What does SOAR stand for?
Security Organization, Assessment, and Reaction
Secondary Organized Automatic Response
Security Orchestration, Automation, and Response
Strategic Operations And Response
16
Which is NOT a feature of SOAR?
Incident Case Management
Incident Response Resolution
Security Incident Response
Security Operation Automation
17
Which is NOT true about SOAR?
Designed to reduce the need to human intervention
Executes automations as incident response functions
Receives incidents from various systems, including SIEM
Has many options but is not fully customizable
