- Welcome to lesson 17,
deep dive quiz.
Now, lesson 17 was all about explaining security alerting
and monitoring concepts and tools.
In 17.1,
we looked at logging and analysis.
And then in 17.2,
we took a really deep look at SNMP,
NetFlow
and SCAP.
So now we're gonna do a five question quiz together.
Make sure you've got a pen or pencil and some paper, right?
Put me on pause as often as you need.
I really want you to be answering these questions.
So you ready?
Let's get started.
We wanna determine if the statements are true or false.
Indicators of attack are artifacts
about events that have already happened.
Indicators of compromise are observable behaviors
or actions.
Automation is the integration
of disparate tools and platforms.
Orchestration is the ability to execute a series of tasks
without human intervention.
So we have four statements, right?
We wanna decide each one if they're true or false.
Go ahead and put me on pause
if you want while you think about it.
And so indicators of attack are about an event
that has already happened.
I'm gonna say that that is false.
Indicators of an attack are really telling us
that something is happening
or about to happen.
Indicators of compromise are observable behaviors
or actions.
That's really what an indicator of an attack is.
Matter of fact, indicator of attack definition above, right,
was really more indicator of compromise.
It's about an event that has already happened.
So I'm gonna say that one is false as well.
Automation is the integration
of disparate tools and platforms.
Is that true or false?
That is not true.
So that's gonna be false.
'Cause what is automation?
Automation really is the ability
to execute a series of tasks
without human intervention.
So that really should help us out on our last one.
Orchestration is the ability
to execute a series of tasks
without human intervention.
That's gonna be false
because orchestration
is the integration of disparate tools and platforms.
So in both cases,
on our indicators of attack and compromise
we swap the definitions.
And in automation and orchestration,
we would need to swap the definitions as well.
You agree that they're all false statements?
Let's check.
And that would be correct.
All right, logs are a critical data source.
What we're gonna do here in question two
is we're gonna match the log analysis technique.
So down the left hand side, we have normalization
deduplication,
correlation,
and aggregation.
On the right hand side,
we really have the description right,
relating log entries,
consolidating log entries,
removing duplicate entries
or standardizing log details.
Put me on pause, you can take a moment and match these up.
All right, well, starting with normalization.
Normalization is when we standardize, right?
So it's standardizing our log details.
Deduplication.
Well, that's gonna be getting rid of duplicates
or removing duplicate entries.
Correlation.
Well, when we correlate something
whether it's logs or anything else, right?
We're relating some to things.
So correlation would be relating our log entries
and aggregation is when we put things together, right?
So that would be consolidating our log entries.
So normalization,
standardizing log details.
Deduplication, removing duplicate entries.
Correlation,
relating log entries
and aggregation, consolidating log entries.
Do you like it? You agree?
We'll check.
And that is correct.
All right, let's go to question three.
Another matching.
This time we're gonna match the automation tool
and its description.
On the left hand
we have SIEM,
TIP,
UEBA
and SOAR.
On the right hand side,
combines multiple threat intelligence feeds,
models the behavior of humans and machines,
real-time data capture and analysis
or responds to alerts and takes action.
Yeah, let's change it up a little bit.
We'll start on the right hand side this time.
Combines multiple threat intelligence feeds.
Well, I like,
TIP, right?
Why TIP?
TIP is our threat intelligence platform.
Next up, we have up on top now,
models the behavior of humans and machines.
I'm gonna choose UEBA.
User and Entity Behavioral Analytics.
Okay, up on top now,
we have realtime data capture and analysis.
Well, that's gonna be our SIEM or our SIEM.
And down at the bottom we have response to alerts
and takes actions.
That's gonna be our SOAR.
So I didn't really pause
and give you time to pause
but I hope that you did
and so you could match this.
But let's go through these,
SIEM, real-time data capture and analysis.
A TIP combines multiple threat intelligence feeds.
UEBA models the behavior of humans
and machines
and SOAR responds to alerts and takes action.
Agree?
Let's check.
And we are correct.
Blank is a suite of open standards
for communicating security flaws
and configuration information.
Is this a CVE,
ISCM,
SCAP
or DOD 5220.22M?
This is a suite of open standards
for communicating security flaws
and configuration information.
Go ahead and make your choice.
Put me on pause if you need to think about it.
Well, I'm gonna choose SCAP.
SCAP is going to be my suite of open standards
or my protocols
for communicating security flaws
and configuration information.
CVE.
Remember, that's a common vulnerability and exposure.
So that would be very specific.
ISCM actually stands for
Information Security Continuous Monitoring
and DOD 5220.22M.
Where do we see that?
We saw that one when we were looking
at disc wiping and sanitation.
So I'm gonna go with SCAP.
You like it?
Let's see, and that is correct.
All right, our last question.
Your organization has been experiencing internet access
bottlenecks and latency.
Which set of troubleshooting tools would you choose?
SNMP and SCAP.
NetFlow and SCAP.
NetFlow and SNMP.
Or SOAR and SIM.
So we've got internet access bottlenecks and latency.
So which two tools was gonna make the most sense,
SNMP and SCAP,
NetFlow and SCAP,
NetFlow and SNMP,
or SOAR and SIM?
You put me on pause while you think about these.
Well, because the issue really is bottlenecks
and latency, right?
The flow of data and how devices are operating.
I'm gonna choose NetFlow and SNMP.
You like that one?
Let's check.
And that's correct.
Well, congratulations.
Another great job.
So what's up next?
We're gonna go into lesson 18.
Given a scenario,
modify enterprise capabilities to enhance security.
I'll see you there.