coursera 2

Automation in a SOC is a good idea for which of the following?

• It is a mandatory requirement in most compliance frameworks

• It requires 24 by 7 operation

• It is already done in other parts of the enterprise

• It reduces response cycle times

• None of the above

Which of the following is a true statement regarding management by exception?

• It involves detecting attacks except where attackers are innocent

• It involves looking for differences from chaos

• It involves looking for differences from normal

• None of the above

Which of the following is a true statement?

• Packet filters use the TCP ACK bit to makes decisions about policy.

• Packet filters use the TCP ACK bit to makes decisions about blocking.

• Packet filters adjust the TCP ACK bit based on management guidance

• None of the above

Enterprise outbound firewall rules to allow port 80 access are designed to do which of the following?

• Protect the corporation from Telnet to Web browsers

• Protect the corporation from Web threats

• Allow employees to enjoy Web sites

• Keep Web malware contained

• None of the above

The biggest challenge to signature-based security for detecting malware is which of the following?

• Difficulty in keeping the lists readable

• Difficulty in managing more than one list

• Behavioral anomalies

• Variants

• All of the above

Packets coming inbound from an internal (IN) source IP address should be viewed as which of the following?

• Probably allowed

• Probably forwarded

• Probably spoofed

• Probably connected to the Internet

• None of the above

Which of the following is a true statement regarding SIEMs?

• A SIEM will not work with proper crypto

• SIEM security requires network tunnels

• SIEMS always require SOCs

• SOCs typically use SIEMS

• All the above.

Firewalls separate:

• Networks from protocols

• Packets from filters

• Networks from networks

• Software from data

• All of the above

Default firewall blocking involves which of the following?

• Including a rule that blocks default addresses

• Includes no rules by default

• Doing default signature checking

• Including no rules

• None of the above

Which of the following is a true statement?

• Firewalls are packet filters

• Packet filters are firewalls

• Packet filters are not firewalls

• Firewalls are never packet filters

• None of the above