Detecting Network Events

Front

This refers to disruptions in network communication that can indicate security incidents or performance issues.

Back

Link and connection failures

Front

It refers to unexpected or excessive data traffic on a network.

Back

Unusual bandwidth consumption

Front

refers to malware periodically communicating with a command and control server to request instructions or exfiltrate data.

Back

Beaconing

Front

What is the primary objective of anomaly-based detection in network traffic analysis?

Back

To establish a normal traffic baseline and detect deviations from it

Front

Which of the following tools is used for signature-based network traffic analysis? Zeek (Bro IDS), Wireshark, Suricata/Snort

Back

Defender for Endpoint

Front

How can Endpoint Detection and Response (EDR) solutions help in responding to beaconing activity?

Back

By providing detailed insights into endpoint behaviors and allowing for faster incident response.

Front

What role do honeypots play in detecting beaconing activity?

Back

They lure attackers into interacting with fake systems, revealing their beaconing activity.

Front

What is a key feature of Security Information and Event Management (SIEM) systems?

Back

They aggregate and correlate data from various security events across the network

Front

Which of the following is an example of unusual bandwidth consumption in a network? Consistent traffic patterns to a well-known server, Stable bandwidth usage across all devices, Regular network traffic to common IP addresses, Sudden spikes in outgoing or incoming traffic

Back

Sudden spikes in outgoing or incoming traffic

Front

What is the main cause of sudden spikes in network traffic?

Back

Anomalies such as data exfiltration or DDoS attacks