Which of the following is a key feature of Snort?

Rule-based detection of network threats

Cloud access policy enforcement

Which of the following events would a FIM system be most likely to alert on?

Network bandwidth usage increases

A configuration file is modified

A security analyst is reviewing detection logs from a network monitoring system and notices a series of failed connection attempts from an internal IP address to multiple external IP addresses on port 445. The analyst wants to determine if this is a scanning activity or a targeted attack. What should the analyst do?

Correlate the detection logs with other logs, such as authentication logs, to identify the source and intent of the activity.

Block the internal IP address immediately to prevent further activity.

Increase the logging level on the network monitoring system to capture more data.

Ignore the activity since it is from an internal IP address.

What is the purpose of detection rules in network monitoring?

To define patterns of traffic that indicate potential security threats

To configure router routing tables

To automatically patch network devices

Which of the following is an example of a detection rule for network monitoring?

Alert when a packet contains a known malware signature

Alert when a user changes their password

CertNexusCyberSec First Responder (CFR)

Domain 2Objective 2

Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 12)

Part of the 2.0 Analyze Attacks on Computing Environments domain, which accounts for 20% of the CYBERSEC-FIRST-RESPONDER exam.

60questions here

12free pages

22concepts

20%of the exam

22 Concepts in This Objective

Active Monitoring Solutions Overview
IDS/IPS Functionality
SIEM Operation
EDR and XDR Capabilities
Threat Intelligence Platforms (TIP)
SOAR Automation
CASB for Cloud Monitoring
File Integrity Monitoring (FIM) Basics
FIM: Detecting File Changes
FIM Alerts and Reports
FIM Scan Schedules
Network Traffic Monitoring Fundamentals
Detection Rules for Network Monitoring
Rule Scripting for Custom Detection
Spoofing Detection Techniques
Beaconing Detection
Whitelisting in Network Monitoring
Traffic Content Inspection
Detection Logs Analysis
Snort IDS/IPS
Suricata IDS/IPS
Zeek Network Security Monitor

Questions 56–60

56foundation · easy
Which of the following is a key feature of Snort?
Select an answer first
57foundation · easy
Which of the following events would a FIM system be most likely to alert on?
Select an answer first
58application · medium
A security analyst is reviewing detection logs from a network monitoring system and notices a series of failed connection attempts from an internal IP address to multiple external IP addresses on port 445. The analyst wants to determine if this is a scanning activity or a targeted attack. What should the analyst do?
Select an answer first
59foundation · easy
What is the purpose of detection rules in network monitoring?
Select an answer first
60foundation · easy
Which of the following is an example of a detection rule for network monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.