Understanding SOC Cyber Security Concepts

What does SIEM stand for in the context of cyber security?

• Security Information and Event Management

• System Information and Event Monitoring

• Security Information and Event Monitoring

• System Information and Event Management

Which of the following best describes a false positive in cyber security?

• A legitimate threat that is not detected

• A non-threatening event that is incorrectly identified as a threat

• A threat that is correctly identified

• A non-threatening event that is correctly ignored

What is a false negative in the context of cyber security?

• A threat that is correctly identified

• A legitimate threat that is not detected

• A non-threatening event that is incorrectly identified as a threat

• A non-threatening event that is correctly ignored

Which of the following is a primary function of logs in cyber security?

• To prevent cyber attacks

• To record and store data about system events

• To encrypt sensitive information

• To manage user access

What does IDS stand for in cyber security?

• Intrusion Detection System

• Information Detection System

• Intrusion Defence System

• Information Defence System

What is the primary purpose of an IPS in cyber security?

• To detect and alert on potential threats

• To prevent and block potential threats

• To log and store data about system events

• To manage user access

Which of the following is a common source of logs in a network?

• User profiles

• Network devices like routers and switches

• Printed documents

• Physical security cameras

In the context of SIEM, what is the main advantage of correlating logs from multiple sources?

• It reduces the amount of data stored

• It helps in identifying complex threats that involve multiple systems

• It increases the speed of data processing

• It simplifies the user interface

Which of the following is a potential drawback of an IDS?

• It can block legitimate traffic

• It can generate false positives

• It can encrypt data

• It can manage user access

What is the main difference between an IDS and an IPS?

• An IDS can block threats, while an IPS only detects them

• An IDS only detects threats, while an IPS can block them

• An IDS is used for logging, while an IPS is used for encryption

• An IDS is used for user management, while an IPS is used for data storage